diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000..1a9594f
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,22 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": ["config:recommended"],
+	"enabledManagers": ["github-actions"],
+	"semanticCommits": "enabled",
+	"minimumReleaseAge": "7 days",
+	"minimumReleaseAgeBehaviour": "timestamp-optional",
+	"pinDigests": true,
+	"packageRules": [
+		{
+			"description": "Dependabot is the primary dependency updater.",
+			"matchPackageNames": ["*"],
+			"enabled": false
+		},
+		{
+			"description": "Update docker:// action references unsupported by Dependabot.",
+			"matchDatasources": ["docker"],
+			"matchDepTypes": ["docker"],
+			"enabled": true
+		}
+	]
+}
diff --git a/.github/workflows/__renovate.yml b/.github/workflows/__renovate.yml
new file mode 100644
index 0000000..de94d37
--- /dev/null
+++ b/.github/workflows/__renovate.yml
@@ -0,0 +1,43 @@
+---
+name: Internal - Renovate dependency updates
+
+on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  schedule:
+    - cron: "23 4 * * 5"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.CI_BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] scheduled maintenance uses the CI bot
+          permission-checks: read
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+          permission-statuses: write
+          permission-workflows: write
+
+      - name: Run Renovate
+        uses: renovatebot/github-action@a63d9a7bc606f7336fd20b47f2f32259a35e6213 # v46.3.9
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+        env:
+          RENOVATE_PLATFORM: github
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_ONBOARDING: "false"
+          RENOVATE_REQUIRE_CONFIG: required
+          RENOVATE_USERNAME: ${{ steps.generate-token.outputs.app-slug }}[bot]
+          RENOVATE_PLATFORM_COMMIT: enabled
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index b3a05de..018b14b 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -153,7 +153,6 @@ jobs:
           working-directory: ${{ steps.has-prettier-plugins.outputs.package-json-dir }}
 
       - name: Run shared Super-Linter image
-        # FIXME: Keep aligned with Dockerfile; Dependabot cannot update docker://
         uses: docker://ghcr.io/hoverkraft-tech/docker-base-images/super-linter:1.1.0@sha256:f600fdd9c95e222b3831181e206db1a58494c45390b0ee0001e32a3c2ddedc75
         env:
           VALIDATE_ALL_CODEBASE: ${{ inputs.lint-all }}
@@ -288,9 +287,7 @@ jobs:
         with:
           persist-credentials: false
 
-      # FIXME: should be updated by dependabot. See https://github.com/dependabot/dependabot-core/issues/8362
-      # https://github.com/sethvargo/ratchet/pkgs/container/ratchet
-      - uses: "docker://ghcr.io/sethvargo/ratchet:0.12.0@sha256:ba6a286f8a53899714d17f89f45134678577431ca483b8000b5dba9267eee36c" # 0.12.0
+      - uses: "docker://ghcr.io/sethvargo/ratchet:0.12.0@sha256:ba6a286f8a53899714d17f89f45134678577431ca483b8000b5dba9267eee36c"
         if: ${{ needs.prepare-actions-linting.outputs.action-files }}
         with:
           args: "lint --format human --format actions ${{ needs.prepare-actions-linting.outputs.action-files }}"
diff --git a/README.md b/README.md
index c97da8c..bbf6294 100644
--- a/README.md
+++ b/README.md
@@ -82,6 +82,28 @@ make lint-fix    # Run Super Linter with autofix enabled
 gh act -W .github/workflows/<workflow>.yml  # Exercise workflows locally when needed
 ```
 
+### Dependency updates
+
+[Dependabot](.github/dependabot.yml) is the primary dependency updater for Dockerfile
+images, GitHub Actions, npm, and devcontainer dependencies.
+[Renovate](.github/renovate.json) only updates tags and digests in `uses: docker://…`
+action references, including Ratchet and Super-Linter, which
+[Dependabot does not support](https://github.com/dependabot/dependabot-core/issues/8362).
+Super-Linter's Dockerfile and workflow references receive separate update pull
+requests from their respective bots; review them together to keep the images aligned.
+
+The [Renovate workflow](.github/workflows/__renovate.yml) runs on Fridays at 04:23 UTC
+and supports manual dispatch. A seven-day release delay applies when registry
+timestamps are available. GHCR updates remain eligible because Renovate's
+[Docker datasource](https://docs.renovatebot.com/modules/datasource/docker/)
+only provides release timestamps for Docker Hub.
+
+The workflow uses the `CI_BOT_APP_CLIENT_ID` variable and `CI_BOT_APP_PRIVATE_KEY`
+secret. The GitHub App
+must be installed on this repository with Checks read access and Contents, Issues,
+Pull requests, Commit statuses, and Workflows write access. Renovate opens pull
+requests for review; automatic merging is disabled.
+
 ## File Structure
 
 ```text