diff --git a/renovate-config.json b/renovate-config.json
index caa8a40..35b0a6a 100644
--- a/renovate-config.json
+++ b/renovate-config.json
@@ -4,6 +4,7 @@
     "EduIDE org-wide Renovate policy. Single source of truth for every repo.",
     "Consume it with: { \"extends\": [\"local>EduIDE/.github:renovate-config\"] }",
     "Policy: no automerge anywhere. Security fixes raised immediately, everything else batched Monday morning.",
+    "forkProcessing is enabled because EduIDE, EduIDE-Cloud and EduIDE-Helm are GitHub forks, and Renovate skips forks by default in autodiscover mode - which is how the Mend hosted app runs. They are actively developed products, not upstream mirrors. This is safe org-wide only because the app installation is scoped to a selected repository list.",
     "See renovate/README.md in this repo for how to change or test this file."
   ],
 
@@ -46,6 +47,8 @@
   "updatePinnedDependencies": true,
   "configMigration": true,
 
+  "forkProcessing": "enabled",
+
   "osvVulnerabilityAlerts": true,
   "vulnerabilityAlerts": {
     "description": "Security fixes bypass the Monday schedule and the release-age quarantine. Rate limits are bypassed unconditionally by Renovate itself.",
diff --git a/renovate/README.md b/renovate/README.md
index a482abe..d3be383 100644
--- a/renovate/README.md
+++ b/renovate/README.md
@@ -117,6 +117,26 @@ tracked and must be bumped by hand. The only way to automate it today is a
 `customDatasources` entry against the open-vsx API, which is still flagged experimental
 upstream; not worth the fragility for two pins. Revisit if open-vsx support lands.
 
+## A repo shows "disabled" in the Mend portal
+
+Two different causes, and only one of them is fixable in git.
+
+**It is a fork.** Renovate skips forked repositories by default in autodiscover mode, which is
+how the hosted app runs - a valid `renovate.json` does not override this. `EduIDE`,
+`EduIDE-Cloud` and `EduIDE-Helm` are forks. The preset sets `"forkProcessing": "enabled"` to
+cover them. That is safe only while the app installation is scoped to a **selected**
+repository list; if someone widens it to "All repositories", this setting would also start
+processing genuine upstream mirrors like `theia`.
+
+**Someone closed its onboarding PR.** Renovate reads a human closing a "Configure Renovate"
+PR as declining, and records that against the repo in the Mend portal. This lives in Mend's
+database, not in the repo, so **no config change clears it** - re-enable the repo at
+<https://developer.mend.io/github/EduIDE>. `EduIDE-deployment` (#40) and
+`EduIDE-Landing-Page` (#4) were both declined this way before the current rollout.
+
+Note that Renovate *auto*-closing an onboarding PR is different and harmless - it does that
+when it finds a repo is already onboarded, and it does not disable anything.
+
 ## Things that are deliberate, not oversights
 
 - **`pinDigests` is off.** Several workflows call `ls1intum/.github/...@feature/...`, which