diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b8132675..15fc3b04 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,10 @@ on:
     branches-ignore:
       - "github-pages"
   pull_request: {}
+env:
+  # renovate: datasource=github-tags depName=golangci/golangci-lint
+  GOLANGCI_LINT_VERSION: "v1.60.3"
+  GOLANG_VERSION: "^1.22.0"
 jobs:
   changes:
     runs-on: ubuntu-latest
@@ -40,11 +44,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "^1.22.0"
+          go-version: "$GOLANG_VERSION"
       - uses: golangci/golangci-lint-action@v6
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-          version: v1.60.3
+          version: "$GOLANGCI_LINT_VERSION"
 
           # Optional: working directory, useful for monorepos
           # working-directory: somedir
@@ -75,7 +79,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "^1.22.0"
+          go-version: "$GOLANG_VERSION"
       - run: make code/build
   build-cross:
     if: |
@@ -93,7 +97,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "^1.22.0"
+          go-version: "$GOLANG_VERSION"
       - run: make code/build-cross
   test:
     if: |
@@ -108,7 +112,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "^1.22.0"
+          go-version: "$GOLANG_VERSION"
       - run: |
           if [ -f /usr/local/bin/dockerize ]; then
             echo "dockerize found; skipping installation";
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index c691435b..9071fdf7 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -4,6 +4,11 @@ on:
     branches-ignore:
       - "github-pages"
   pull_request: {}
+env:
+  # renovate: datasource=docker depName=squidfunk/mkdocs-material
+  MKDOCS_MATERIAL_VERSION: "9.5.15"
+  # renovate: datasource=pypi depName=mkdocs-awesome-pages-plugin
+  MKDOCS_AWESOME_PAGES_PLUGIN_VERSION: "2.8.0"
 jobs:
   changes:
     runs-on: ubuntu-latest
@@ -34,8 +39,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: 3.x
-      - run: pip install mkdocs-material==9.5.15
-      - run: pip install mkdocs-awesome-pages-plugin==2.8.0
+      - run: pip install mkdocs-material==$MKDOCS_MATERIAL_VERSION
+      - run: pip install mkdocs-awesome-pages-plugin==$MKDOCS_AWESOME_PAGES_PLUGIN_VERSION
       - run: mkdocs build
   docs-deploy:
     needs:
@@ -50,6 +55,6 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: 3.x
-      - run: pip install mkdocs-material==9.5.15
-      - run: pip install mkdocs-awesome-pages-plugin==2.8.0
+      - run: pip install mkdocs-material==$MKDOCS_MATERIAL_VERSION
+      - run: pip install mkdocs-awesome-pages-plugin==$MKDOCS_AWESOME_PAGES_PLUGIN_VERSION
       - run: mkdocs gh-deploy --force
diff --git a/Dockerfile.docs b/Dockerfile.docs
index 619e0e6f..133ffb52 100644
--- a/Dockerfile.docs
+++ b/Dockerfile.docs
@@ -1,3 +1,6 @@
 FROM squidfunk/mkdocs-material:9.5.15
 
-RUN pip install mkdocs-awesome-pages-plugin==2.8.0
+# renovate: datasource=pypi depName=mkdocs-awesome-pages-plugin
+ENV MKDOCS_AWESOME_PAGES_PLUGIN_VERSION="2.8.0"
+
+RUN pip install mkdocs-awesome-pages-plugin==${MKDOCS_AWESOME_PAGES_PLUGIN_VERSION}
diff --git a/Makefile b/Makefile
index 399d2d9e..4588be0f 100644
--- a/Makefile
+++ b/Makefile
@@ -34,6 +34,15 @@ HAS_MOCKGEN:=$(shell command -v mockgen;)
 HAS_GOTESTSUM:=$(shell command -v gotestsum;)
 HAS_FIELDALIGNMENT:=$(shell command -v fieldalignment;)
 
+#
+## Tool versions
+#
+
+# ? Note: Go install versions are inline because renovate can manage them like that.
+
+# renovate: datasource=github-tags depName=golangci/golangci-lint
+GOLANGCI_LINT_VERSION := "v1.60.3"
+
 .DEFAULT_GOAL := code/lint
 
 #############
@@ -175,7 +184,7 @@ ifndef HAS_GOLANGCI_LINT
 ifndef HAS_CURL
 	$(error You must install curl)
 endif
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(shell go env GOPATH)/bin v1.60.3
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(shell go env GOPATH)/bin $(GOLANGCI_LINT_VERSION)
 endif
 ifndef HAS_GIT
 	$(error You must install Git)
diff --git a/renovate.json b/renovate.json
index 585b62fc..23c39133 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,4 +1,43 @@
 {
-  "extends": ["config:base"],
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":rebaseStalePrs",
+    ":semanticCommits",
+    ":semanticCommitScope(deps)"
+  ],
+  "configMigration": true,
+  "labels": ["renovate"],
+  "pre-commit": {
+    "enabled": true
+  },
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["vulnerability-alert"]
+  },
+  "packageRules": [
+    {
+      "groupName": "mkdocs",
+      "groupSlug": "mkdocs",
+      "matchPackageNames": ["mkdocs-material", "squidfunk/mkdocs-material"]
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^Makefile$", "^.github/workflows/.*\\.yml"],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\s.*?_VERSION\\s*[:=]+\\s*\"(?<currentValue>.*)\"\\s"
+      ],
+      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
+    },
+    {
+      "fileMatch": ["^Makefile$"],
+      "matchStrings": [
+        "go install (?<depName>[^@]+?)@(?<currentValue>[0-9.-a-zA-Z]+)"
+      ],
+      "datasourceTemplate": "go"
+    }
+  ],
   "ignoreDeps": ["github.com/aws/aws-sdk-go"]
 }