diff --git a/.forgejo/workflows/renovate.yaml b/.forgejo/workflows/renovate.yaml
new file mode 100644
index 0000000..bba8440
--- /dev/null
+++ b/.forgejo/workflows/renovate.yaml
@@ -0,0 +1,32 @@
+name: renovate
+
+# Opens a PR per available version bump (image tags, restic, ...), with
+# the upstream release notes in the PR body. Configuration: renovate.json.
+#
+# Secrets: RENOVATE_TOKEN (Forgejo token of the renovate-bot user, a
+# collaborator with write access) and GH_COM_TOKEN (read-only github.com
+# token, only for fetching release notes; without it PRs have none).
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/renovatebot/renovate:44.236.2
+    steps:
+      - name: Run Renovate
+        env:
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: https://git.asxp.io/api/v1
+          RENOVATE_REPOSITORIES: asxpi/infrastructure
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.git.asxp.io>"
+          RENOVATE_ONBOARDING: "false"
+          RENOVATE_REQUIRE_CONFIG: required
+          LOG_LEVEL: info
+        run: renovate
diff --git a/ansible/inventory/group_vars/ops_servers/forgejo.yaml b/ansible/inventory/group_vars/ops_servers/forgejo.yaml
index c8ef54d..be09d67 100644
--- a/ansible/inventory/group_vars/ops_servers/forgejo.yaml
+++ b/ansible/inventory/group_vars/ops_servers/forgejo.yaml
@@ -1,4 +1,5 @@
 ---
+# renovate: datasource=docker depName=codeberg.org/forgejo/forgejo
 forgejo_version: "15.0.11"
 
 # The instance answers on every name below. forgejo_domain is the
diff --git a/ansible/inventory/group_vars/ops_servers/traefik.yaml b/ansible/inventory/group_vars/ops_servers/traefik.yaml
index ce8f47c..0a55c8b 100644
--- a/ansible/inventory/group_vars/ops_servers/traefik.yaml
+++ b/ansible/inventory/group_vars/ops_servers/traefik.yaml
@@ -1,4 +1,5 @@
 ---
+# renovate: datasource=docker depName=traefik
 traefik_version: "v3.7.18"
 traefik_base_path: "{{ services_base_path }}/traefik"
 traefik_dashboard_port: 8080
diff --git a/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml b/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml
index 93b47c4..a4f5315 100644
--- a/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml
+++ b/ansible/inventory/group_vars/services_servers/forgejo_runner.yaml
@@ -2,6 +2,7 @@
 # Forgejo Runner (CI/CD) configuration
 
 # Runner version and settings
+# renovate: datasource=docker depName=code.forgejo.org/forgejo/runner
 forgejo_runner_version: "11"
 forgejo_runner_capacity: 4
 forgejo_runner_timeout: 3h
@@ -10,6 +11,7 @@ forgejo_runner_timeout: 3h
 # /nix, seeded from this image on first use; the image's /bin/sh and
 # /etc/nix/nix.conf link into that store, so a volume from another
 # version breaks them. Bumping this also switches to a fresh volume.
+# renovate: datasource=docker depName=nixos/nix
 forgejo_runner_nix_version: "2.35.3"
 forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
 
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..0aefbf6
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,41 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", ":disableDependencyDashboard"],
+  "timezone": "Europe/Helsinki",
+  "labels": ["dependencies"],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 10,
+  "commitMessagePrefix": "deps:",
+  "customManagers": [
+    {
+      "description": "Versions in Ansible vars, marked with a comment: # renovate: datasource=<ds> depName=<name>",
+      "customType": "regex",
+      "managerFilePatterns": ["/^ansible/.+\\.ya?ml$/"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+[a-z_0-9]+:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
+      ]
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "Paper needs Java 21; the tag is a floating JRE line",
+      "matchPackageNames": ["eclipse-temurin"],
+      "enabled": false
+    },
+    {
+      "description": "Every job runs this image and a nix-store volume tied to its version",
+      "matchPackageNames": ["nixos/nix"],
+      "prBodyNotes": ["After merging, remove the old `nix-store-<old version>` volume on asxpio-services (see forgejo_runner.yaml)."]
+    },
+    {
+      "description": "A runner change recreates the runner mid-job",
+      "matchPackageNames": ["code.forgejo.org/forgejo/runner"],
+      "prBodyNotes": ["The deploy job that applies this shows as cancelled; the next run confirms the result."]
+    },
+    {
+      "description": "Renovate itself releases daily; once a month is enough",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "schedule": ["* * 1 * *"]
+    }
+  ]
+}