diff --git a/.github/workflows/lint-policy-in-other-repos.yml b/.github/workflows/lint-policy-in-other-repos.yml
index f99cac5..f5dfc7d 100644
--- a/.github/workflows/lint-policy-in-other-repos.yml
+++ b/.github/workflows/lint-policy-in-other-repos.yml
@@ -37,7 +37,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
-          python-version: "3.15"
+          python-version: "3.14"
       - name: Install dependencies
         working-directory: cfengine-cli
         run: |
diff --git a/.github/workflows/update-syntax-description.yml b/.github/workflows/update-syntax-description.yml
index e13a23d..141881f 100644
--- a/.github/workflows/update-syntax-description.yml
+++ b/.github/workflows/update-syntax-description.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Set up Python 3.12
         uses: actions/setup-python@v7
         with:
-          python-version: "3.15"
+          python-version: "3.14"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
diff --git a/renovate.json5 b/renovate.json5
index 70a2b40..ca6436e 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -74,10 +74,12 @@
 
     // The python version is also pinned in the make-check matrix and in the
     // classifiers, which Renovate cannot reach. One PR, not three.
+    // Capped at 3.14 because that is what users run; raise deliberately.
     {
       matchDepNames: ["python"],
       groupName: "python-version",
       groupSlug: "python-version",
+      allowedVersions: "<3.15",
     },
 
     // Support floor, not a dependency. "bump" would raise it to ">=3.14.7"