diff --git a/.github/ng-renovate/runner-config.js b/.github/ng-renovate/runner-config.js
index b7bc7e511..11cf62133 100644
--- a/.github/ng-renovate/runner-config.js
+++ b/.github/ng-renovate/runner-config.js
@@ -9,6 +9,8 @@ module.exports = {
   // Renovate fork PRs should never be editable as Renovate would otherwise
   // not be able to delete the branches and future updates would be missed.
   forkModeDisallowMaintainerEdits: true,
+  // Needed for `bazel mod deps --lockfile_mode=update`.
+  allowedUnsafeExecutions: ['bazelModDeps'],
   onboarding: false,
   persistRepoData: true,
   allowedCommands: ['.'],