diff --git a/composer.json b/composer.json
index cd28e853..2344f3d7 100644
--- a/composer.json
+++ b/composer.json
@@ -27,7 +27,7 @@
         "dantleech/gherkin-lint": "^0.2.4",
         "dealerdirect/phpcodesniffer-composer-installer": "^1.2.1",
         "dmore/behat-chrome-extension": "^1.4.1",
-        "drevops/behat-phpserver": "^2.3.0",
+        "drevops/behat-phpserver": "^2.4.0",
         "drevops/behat-screenshot": "^2.6.0",
         "drevops/phpcs-standard": "^0.7",
         "drupal/coder": "^8.3.31",
diff --git a/renovate.json b/renovate.json
index 0319717c..d4839003 100644
--- a/renovate.json
+++ b/renovate.json
@@ -5,12 +5,26 @@
     "dependencyDashboard": true,
     "pinDigests": true,
     "branchPrefix": "deps/",
+    "ignorePaths": [
+        "**/node_modules/**",
+        "**/bower_components/**",
+        "**/vendor/**",
+        "**/examples/**",
+        "**/__tests__/**",
+        "**/__fixtures__/**"
+    ],
     "packageRules": [
         {
             "description": "The image name in this file is assembled from a build argument, so a pinned digest would only ever resolve for one of the PHP versions in the test matrix.",
             "matchFileNames": [".docker/cli.dockerfile"],
             "pinDigests": false
         },
+        {
+            "description": "The Drupal 11 fixture stays on 11.3 because 11.4 deprecates core functions whose replacements do not exist in Drupal 10, which this library still supports.",
+            "matchFileNames": ["tests/behat/fixtures_drupal/d11/composer.json"],
+            "matchPackageNames": ["drupal/core-*"],
+            "enabled": false
+        },
         {
             "matchDepNames": ["php"],
             "matchManagers": ["composer"],
diff --git a/tests/behat/fixtures_drupal/README.md b/tests/behat/fixtures_drupal/README.md
index 443e74ec..746997a7 100644
--- a/tests/behat/fixtures_drupal/README.md
+++ b/tests/behat/fixtures_drupal/README.md
@@ -263,7 +263,7 @@ If a new test requires additional Drupal modules:
 
 ### Drupal 10 (d10/)
 - PHP >= 8.2
-- Drupal core: `~10.5.0`
+- Drupal core: `~10.6.0`
 - CKEditor 5 (replaces CKEditor 4)
 
 ### Drupal 11 (d11/)
@@ -271,6 +271,8 @@ If a new test requires additional Drupal modules:
 - Drupal core: `~11.3.0`
 - All modules must be Drupal 11 compatible
 
+Renovate tracks both fixtures and raises the Drupal 10 constraint to each new minor. The Drupal 11 constraint is held at `~11.3.0` by a `renovate.json` package rule: 11.4 deprecates `node_access_rebuild()` and `user_pass_rehash()`, and their replacements do not exist in Drupal 10. Moving the fixture past 11.3 is blocked on dropping Drupal 10 support.
+
 ## Testing Flow
 
 1. **Fixture build**: `ahoy build` installs Drupal in `build/` using fixtures
diff --git a/tests/behat/fixtures_drupal/d10/composer.json b/tests/behat/fixtures_drupal/d10/composer.json
index 1a0e39cd..1f0fca5a 100644
--- a/tests/behat/fixtures_drupal/d10/composer.json
+++ b/tests/behat/fixtures_drupal/d10/composer.json
@@ -7,9 +7,9 @@
         "php": ">=8.2",
         "composer/installers": "^2.3",
         "cweagans/composer-patches": "^1.7.3",
-        "drupal/core-composer-scaffold": "~10.5.0",
-        "drupal/core-project-message": "~10.5.0",
-        "drupal/core-recommended": "~10.5.0",
+        "drupal/core-composer-scaffold": "~10.6.0",
+        "drupal/core-project-message": "~10.6.0",
+        "drupal/core-recommended": "~10.6.0",
         "grasmash/yaml-cli": "^3.2.1",
         "symfony/browser-kit": "^6.4.3",
         "symfony/config": "^6.4.3",
@@ -29,7 +29,7 @@
         "webflo/drupal-finder": "^1.3.1"
     },
     "require-dev": {
-        "drupal/core-dev": "~10.5.0",
+        "drupal/core-dev": "~10.6.0",
         "phpunit/php-code-coverage": "^9.2.31"
     },
     "conflict": {