diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e3439fa..229ee007 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,8 +19,11 @@ jobs:
         with:
           persist-credentials: false
       - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204 # v3.0.1
+        env:
+          # renovate: datasource=github-releases depName=j178/prek extractVersion=^v(?<version>.+)$
+          PREK_VERSION: 0.5.5
         with:
-          prek-version: 0.5.5
+          prek-version: ${{ env.PREK_VERSION }}
 
   sanity-checks:
     permissions:
diff --git a/renovate.json5 b/renovate.json5
new file mode 100644
index 00000000..69674c65
--- /dev/null
+++ b/renovate.json5
@@ -0,0 +1,32 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+
+  // Dependabot keeps the action SHAs, npm, docker and pre-commit hooks (.github/dependabot.yml).
+  // Renovate owns only the annotated *_VERSION values CI installs, so only custom.regex runs.
+  extends: ["config:recommended", "customManagers:githubActionsVersions"],
+  enabledManagers: ["custom.regex"],
+
+  // Policy shared by every repository Renovate updates; keep the copies alike.
+  semanticCommits: "enabled",
+  dependencyDashboard: true,
+  minimumReleaseAge: "7 days",
+  minimumReleaseAgeBehaviour: "timestamp-optional",
+  prHourlyLimit: 0,
+  prConcurrentLimit: 10,
+  osvVulnerabilityAlerts: true,
+  vulnerabilityAlerts: {
+    semanticCommitType: "fix",
+    labels: ["security"],
+  },
+
+  packageRules: [
+    {
+      matchUpdateTypes: ["major"],
+      minimumReleaseAge: "14 days",
+    },
+    {
+      matchFileNames: [".github/workflows/**"],
+      semanticCommitScope: "ci",
+    },
+  ],
+}