diff --git a/default.json b/default.json
index 789f6b8..99c8dc3 100644
--- a/default.json
+++ b/default.json
@@ -35,17 +35,6 @@
         "*"
       ]
     },
-    {
-      "description": "🚫 Production environments - disable automerge",
-      "matchFileNames": [
-        "**/production/**"
-      ],
-      "automerge": false,
-      "prPriority": -1,
-      "addLabels": [
-        "⚠️ production"
-      ]
-    },
     {
       "description": "🚫 Major updates - disable automerge",
       "matchUpdateTypes": [
@@ -72,6 +61,17 @@
         "panicboat/.github"
       ],
       "minimumReleaseAge": null
+    },
+    {
+      "description": "🚫 Production environments - disable automerge",
+      "matchFileNames": [
+        "**/production/**"
+      ],
+      "automerge": false,
+      "prPriority": -1,
+      "addLabels": [
+        "⚠️ production"
+      ]
     }
   ]
 }
diff --git a/scripts/workflows/test.sh b/scripts/workflows/test.sh
index 20ddf11..e8a7795 100755
--- a/scripts/workflows/test.sh
+++ b/scripts/workflows/test.sh
@@ -49,6 +49,12 @@ test_resolver_skips_label_resolver_without_a_pull_request() {
     assert_eq "needs.resolve.outputs.has-targets == 'true' &&" "$(yq '.jobs["deploy-terragrunt"].if' "${workflow}" | head -n 1)"
 }
 
+test_renovate_keeps_production_out_of_automerge() {
+    # Renovate applies matching packageRules in order, so a later rule overrides the production rule.
+    assert_eq "false" "$(jq -r '[.packageRules[] | select(.automerge != null) | select(.matchFileNames // [] | index("**/production/**"))][0].automerge' "${repo_root}/default.json")"
+    assert_eq "production" "$(jq -r '[.packageRules[] | select(.automerge != null)] | last | if (.matchFileNames // [] | index("**/production/**")) != null then "production" else "other" end' "${repo_root}/default.json")"
+}
+
 test_workflows_do_not_read_apply_trigger() {
     assert_eq "" "$(grep -rl --exclude='*test.sh' 'apply_trigger\|validate-apply-trigger' "${workflows_dir}" "${repo_root}/scripts" || true)"
 }