diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 4397cbc..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "docker-compose"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    commit-message:
-      prefix: "docker"
-      include: "scope"
-    directories:
-      - "/docker/home/esphome"
-      - "/docker/home/mosquitto-mqtt"
-      - "/docker/home/n8n"
-      - "/docker/home/node-red"
-      - "/docker/home/zigbee2mqtt"
-      - "/docker/infrastructure/mail/roundcube"
-      - "/docker/infrastructure/network/traefik"
-      - "/docker/infrastructure/observability"
-      - "/docker/infrastructure/squid"
-      - "/docker/personal/fireshare"
-      - "/docker/personal/gramps"
-      - "/docker/personal/media/films-series/jackett"
-      - "/docker/personal/media/films-series/jellyfin"
-      - "/docker/personal/media/films-series/jellyseerr"
-      - "/docker/personal/media/films-series/radarr"
-      - "/docker/personal/media/films-series/sonarr"
-      - "/docker/personal/media/films-series/transmission"
-      - "/docker/personal/media/films-series/wizarr"
-      - "/docker/personal/media/music/navidrome"
-      - "/docker/personal/media/youtube/tubearchivist"
-      - "/docker/personal/radicale"
-      - "/docker/personal/syncthing"
-      - "/docker/personal/tandoor"
-      - "/docker/production/alexscript"
-      - "/docker/tools/excalidraw"
-      - "/docker/tools/stirling-pdf"
-  - package-ecosystem: "helm"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    commit-message:
-      prefix: "kube"
-      include: "scope"
-    directories:
-      - "/kubernetes/dev/gitea"
-      - "/kubernetes/dev/harbor"
-      - "/kubernetes/home/home-assistant"
-      - "/kubernetes/home/zigbee2mqtt"
-      - "/kubernetes/infrastructure/authentik"
-      - "/kubernetes/infrastructure/caddy"
-      - "/kubernetes/infrastructure/cert-manager"
-      - "/kubernetes/infrastructure/cert-manager-webhook-ovh"
-      - "/kubernetes/infrastructure/mail/stalwart"
-      - "/kubernetes/infrastructure/network/blocky"
-      - "/kubernetes/infrastructure/traefik"
-      - "/kubernetes/personal/media/photoprism"
-      - "/kubernetes/personal/notes/notesnook"
-      - "/kubernetes/personal/notes/obsidian-livesync"
-      - "/kubernetes/personal/paperless"
-      - "/kubernetes/personal/radicale"
-      - "/kubernetes/production/buildpath"
-      - "/kubernetes/production/semery-fr"
-      - "/kubernetes/production/umami"
-      - "/kubernetes/production/vhaudiquet-fr"
-      - "/kubernetes/system/coredns"
-      - "/kubernetes/system/csi-driver-nfs"
-      - "/kubernetes/system/external-dns"
-      - "/kubernetes/system/longhorn"
-      - "/kubernetes/system/openclaw-operator"
-      - "/kubernetes/utilities/dashy"
-      - "/kubernetes/utilities/glance"
-      - "/kubernetes/utilities/open-webui"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6ae4e72..cc18b2e 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -6,9 +6,9 @@ repos:
         entry: .pre-commit-sops.sh
         language: script
         pass_filenames: true
-      - id: generate-dependabot
-        name: generate dependabot
-        entry: generate-dependabot.sh
+      - id: generate-renovate
+        name: generate renovate
+        entry: generate-renovate.sh
         language: script
         pass_filenames: false
       - id: generate-docker-swarmcd
diff --git a/generate-dependabot.sh b/generate-dependabot.sh
deleted file mode 100755
index 0aa5ca6..0000000
--- a/generate-dependabot.sh
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/bin/bash
-
-# Create .github directory if needed
-if [ ! -d .github ]; then
-    mkdir -p .github
-fi
-
-tmpfile=$(mktemp)
-
-# Make sure to cleanup our temp file on any kind of exit
-trap 'rm -f "$tmpfile"' EXIT
-
-# dependabot.yml docker header
-cat > "$tmpfile" <<'YAML'
-version: 2
-updates:
-  - package-ecosystem: "docker-compose"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    commit-message:
-      prefix: "docker"
-      include: "scope"
-    directories:
-YAML
-
-# Find and sort all docker-compose.yml directories
-find docker -name 'docker-compose.yml' -print0 \
-  | xargs -0 -n1 dirname \
-  | sed 's|^\./||' \
-  | sort \
-  | while read -r dir; do
-      echo "      - \"/$dir\"" >> "$tmpfile"
-    done
-  
-# dependabot.yml helm header
-cat >> "$tmpfile" <<'YAML'
-  - package-ecosystem: "helm"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    commit-message:
-      prefix: "kube"
-      include: "scope"
-    directories:
-YAML
-
-# Find and sort all release.yaml directories
-find kubernetes -name 'release.yaml' -print0 \
-  | xargs -0 -n1 dirname \
-  | sed 's|^\./||' \
-  | sort \
-  | while read -r dir; do
-      echo "      - \"/$dir\"" >> "$tmpfile"
-    done
-
-# Overwrite file on change
-if ! [ -f .github/dependabot.yml ] || ! cmp -s "$tmpfile" .github/dependabot.yml; then
-  mv "$tmpfile" .github/dependabot.yml
-  echo "Updated .github/dependabot.yml!"
-  git add ".github/dependabot.yml"
-else
-  echo "No changes to .github/dependabot.yml."
-fi
\ No newline at end of file
diff --git a/generate-renovate.sh b/generate-renovate.sh
new file mode 100755
index 0000000..a4233f5
--- /dev/null
+++ b/generate-renovate.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+set -euo pipefail
+
+# Regenerate renovate.json from the on-disk docker/kubernetes layout.
+
+tmpfile=$(mktemp)
+
+# Make sure to cleanup our temp file on any kind of exit
+trap 'rm -f "$tmpfile"' EXIT
+
+python3 - "$tmpfile" <<'PY'
+import json
+import os
+import subprocess
+import sys
+
+
+def discover(root, filename):
+    """Sorted directories under root containing filename."""
+    out = subprocess.run(
+        ["find", root, "-name", filename],
+        capture_output=True,
+        text=True,
+        check=True,
+    ).stdout
+    return sorted(
+        {os.path.dirname(line).removeprefix("./") for line in out.splitlines() if line}
+    )
+
+
+def file_match(directory, filename):
+    return "^%s/%s$" % (directory, filename.replace(".", "[.]"))
+
+
+docker_dirs = discover("docker", "docker-compose.yml")
+helm_dirs = discover("kubernetes", "release.yaml")
+
+renovate = {
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "schedule": ["every weekend"],
+    "prConcurrentLimit": 15,
+    "enabledManagers": ["docker-compose", "helm-requirements", "helm-values"],
+    "packageRules": [
+        {
+            "description": "docker-compose updates",
+            "matchManagers": ["docker-compose"],
+            "commitMessage": "docker(deps): bump {{{depName}}} in {{{packageFile}}}",
+        },
+        {
+            "description": "helm updates",
+            "matchManagers": ["helm-requirements", "helm-values"],
+            "commitMessage": "kube(deps): bump {{{depName}}} in {{{packageFile}}}",
+        },
+    ],
+    "docker-compose": {
+        "fileMatch": [file_match(d, "docker-compose.yml") for d in docker_dirs]
+    },
+    "helm-requirements": {"fileMatch": [file_match(d, "Chart.yaml") for d in helm_dirs]},
+    "helm-values": {"fileMatch": [file_match(d, "values.yaml") for d in helm_dirs]},
+}
+
+with open(sys.argv[1], "w") as f:
+    json.dump(renovate, f, indent=2)
+    f.write("\n")
+PY
+
+# Overwrite file on change
+if ! [ -f renovate.json ] || ! cmp -s "$tmpfile" renovate.json; then
+  mv "$tmpfile" renovate.json
+  echo "Updated renovate.json!"
+  git add "renovate.json"
+else
+  echo "No changes to renovate.json."
+fi
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..18f7e4a
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,123 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "schedule": [
+    "every weekend"
+  ],
+  "prConcurrentLimit": 15,
+  "enabledManagers": [
+    "docker-compose",
+    "helm-requirements",
+    "helm-values"
+  ],
+  "packageRules": [
+    {
+      "description": "docker-compose updates",
+      "matchManagers": [
+        "docker-compose"
+      ],
+      "commitMessage": "docker(deps): bump {{{depName}}} in {{{packageFile}}}"
+    },
+    {
+      "description": "helm updates",
+      "matchManagers": [
+        "helm-requirements",
+        "helm-values"
+      ],
+      "commitMessage": "kube(deps): bump {{{depName}}} in {{{packageFile}}}"
+    }
+  ],
+  "docker-compose": {
+    "fileMatch": [
+      "^docker/home/esphome/docker-compose[.]yml$",
+      "^docker/home/mosquitto-mqtt/docker-compose[.]yml$",
+      "^docker/home/n8n/docker-compose[.]yml$",
+      "^docker/home/node-red/docker-compose[.]yml$",
+      "^docker/home/zigbee2mqtt/docker-compose[.]yml$",
+      "^docker/infrastructure/mail/roundcube/docker-compose[.]yml$",
+      "^docker/infrastructure/network/traefik/docker-compose[.]yml$",
+      "^docker/infrastructure/observability/docker-compose[.]yml$",
+      "^docker/infrastructure/squid/docker-compose[.]yml$",
+      "^docker/personal/fireshare/docker-compose[.]yml$",
+      "^docker/personal/gramps/docker-compose[.]yml$",
+      "^docker/personal/media/films-series/jackett/docker-compose[.]yml$",
+      "^docker/personal/media/films-series/jellyfin/docker-compose[.]yml$",
+      "^docker/personal/media/films-series/jellyseerr/docker-compose[.]yml$",
+      "^docker/personal/media/films-series/radarr/docker-compose[.]yml$",
+      "^docker/personal/media/films-series/sonarr/docker-compose[.]yml$",
+      "^docker/personal/media/films-series/transmission/docker-compose[.]yml$",
+      "^docker/personal/media/films-series/wizarr/docker-compose[.]yml$",
+      "^docker/personal/media/music/navidrome/docker-compose[.]yml$",
+      "^docker/personal/media/youtube/tubearchivist/docker-compose[.]yml$",
+      "^docker/personal/radicale/docker-compose[.]yml$",
+      "^docker/personal/syncthing/docker-compose[.]yml$",
+      "^docker/personal/tandoor/docker-compose[.]yml$",
+      "^docker/production/alexscript/docker-compose[.]yml$",
+      "^docker/tools/excalidraw/docker-compose[.]yml$",
+      "^docker/tools/stirling-pdf/docker-compose[.]yml$"
+    ]
+  },
+  "helm-requirements": {
+    "fileMatch": [
+      "^kubernetes/dev/gitea/Chart[.]yaml$",
+      "^kubernetes/dev/harbor/Chart[.]yaml$",
+      "^kubernetes/home/home-assistant/Chart[.]yaml$",
+      "^kubernetes/home/zigbee2mqtt/Chart[.]yaml$",
+      "^kubernetes/infrastructure/authentik/Chart[.]yaml$",
+      "^kubernetes/infrastructure/caddy/Chart[.]yaml$",
+      "^kubernetes/infrastructure/cert-manager/Chart[.]yaml$",
+      "^kubernetes/infrastructure/cert-manager-webhook-ovh/Chart[.]yaml$",
+      "^kubernetes/infrastructure/mail/stalwart/Chart[.]yaml$",
+      "^kubernetes/infrastructure/network/blocky/Chart[.]yaml$",
+      "^kubernetes/infrastructure/traefik/Chart[.]yaml$",
+      "^kubernetes/personal/media/photoprism/Chart[.]yaml$",
+      "^kubernetes/personal/notes/notesnook/Chart[.]yaml$",
+      "^kubernetes/personal/notes/obsidian-livesync/Chart[.]yaml$",
+      "^kubernetes/personal/paperless/Chart[.]yaml$",
+      "^kubernetes/personal/radicale/Chart[.]yaml$",
+      "^kubernetes/production/buildpath/Chart[.]yaml$",
+      "^kubernetes/production/semery-fr/Chart[.]yaml$",
+      "^kubernetes/production/umami/Chart[.]yaml$",
+      "^kubernetes/production/vhaudiquet-fr/Chart[.]yaml$",
+      "^kubernetes/system/coredns/Chart[.]yaml$",
+      "^kubernetes/system/csi-driver-nfs/Chart[.]yaml$",
+      "^kubernetes/system/external-dns/Chart[.]yaml$",
+      "^kubernetes/system/longhorn/Chart[.]yaml$",
+      "^kubernetes/system/openclaw-operator/Chart[.]yaml$",
+      "^kubernetes/utilities/dashy/Chart[.]yaml$",
+      "^kubernetes/utilities/glance/Chart[.]yaml$",
+      "^kubernetes/utilities/open-webui/Chart[.]yaml$"
+    ]
+  },
+  "helm-values": {
+    "fileMatch": [
+      "^kubernetes/dev/gitea/values[.]yaml$",
+      "^kubernetes/dev/harbor/values[.]yaml$",
+      "^kubernetes/home/home-assistant/values[.]yaml$",
+      "^kubernetes/home/zigbee2mqtt/values[.]yaml$",
+      "^kubernetes/infrastructure/authentik/values[.]yaml$",
+      "^kubernetes/infrastructure/caddy/values[.]yaml$",
+      "^kubernetes/infrastructure/cert-manager/values[.]yaml$",
+      "^kubernetes/infrastructure/cert-manager-webhook-ovh/values[.]yaml$",
+      "^kubernetes/infrastructure/mail/stalwart/values[.]yaml$",
+      "^kubernetes/infrastructure/network/blocky/values[.]yaml$",
+      "^kubernetes/infrastructure/traefik/values[.]yaml$",
+      "^kubernetes/personal/media/photoprism/values[.]yaml$",
+      "^kubernetes/personal/notes/notesnook/values[.]yaml$",
+      "^kubernetes/personal/notes/obsidian-livesync/values[.]yaml$",
+      "^kubernetes/personal/paperless/values[.]yaml$",
+      "^kubernetes/personal/radicale/values[.]yaml$",
+      "^kubernetes/production/buildpath/values[.]yaml$",
+      "^kubernetes/production/semery-fr/values[.]yaml$",
+      "^kubernetes/production/umami/values[.]yaml$",
+      "^kubernetes/production/vhaudiquet-fr/values[.]yaml$",
+      "^kubernetes/system/coredns/values[.]yaml$",
+      "^kubernetes/system/csi-driver-nfs/values[.]yaml$",
+      "^kubernetes/system/external-dns/values[.]yaml$",
+      "^kubernetes/system/longhorn/values[.]yaml$",
+      "^kubernetes/system/openclaw-operator/values[.]yaml$",
+      "^kubernetes/utilities/dashy/values[.]yaml$",
+      "^kubernetes/utilities/glance/values[.]yaml$",
+      "^kubernetes/utilities/open-webui/values[.]yaml$"
+    ]
+  }
+}