diff --git a/.github/buildomat/config.toml b/.github/buildomat/config.toml
index 703e7ae8..ca7a5d60 100644
--- a/.github/buildomat/config.toml
+++ b/.github/buildomat/config.toml
@@ -3,3 +3,18 @@
 # the buildomat integration to create check suites.
 #
 enable = true
+
+#
+# Require approval for pull requests made by users outside our organisation.
+#
+org_only = true
+
+#
+# We accept pull requests from several automated services that are outside the
+# organisation.  Allow jobs from those sources to proceed without manual
+# approval:
+#
+allow_users = [
+	"dependabot[bot]",
+	"renovate[bot]",
+]