diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 00000000..000cf7ab
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,22 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": ["config:recommended"],
+	"enabledManagers": ["custom.regex"],
+	"semanticCommits": "enabled",
+	"minimumReleaseAge": "7 days",
+	"packageRules": [
+		{
+			"matchManagers": ["custom.regex"],
+			"groupName": "Docker build tooling"
+		}
+	],
+	"customManagers": [
+		{
+			"customType": "regex",
+			"managerFilePatterns": ["/^actions/docker/setup/action\\.yml$/"],
+			"matchStrings": [
+				"# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) versioning=(?<versioning>\\S+)\\s+default: \"(?:[^\"\\s]+:)?(?<currentValue>[^\"\\s]+)\""
+			]
+		}
+	]
+}
diff --git a/.github/workflows/__renovate.yml b/.github/workflows/__renovate.yml
new file mode 100644
index 00000000..07fc8ab2
--- /dev/null
+++ b/.github/workflows/__renovate.yml
@@ -0,0 +1,42 @@
+---
+name: Internal - Renovate dependency updates
+
+on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  schedule:
+    - cron: "23 4 * * 5"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.CI_BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env]
+          permission-checks: read
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+          permission-statuses: write
+
+      - name: Run Renovate
+        uses: renovatebot/github-action@f0f41e5f2e706165f6814b1d0f0d0e319de7d1d9 # v46.3.8
+        with:
+          token: ${{ steps.generate-token.outputs.token }}
+        env:
+          RENOVATE_PLATFORM: github
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_ONBOARDING: "false"
+          RENOVATE_REQUIRE_CONFIG: required
+          RENOVATE_USERNAME: ${{ steps.generate-token.outputs.app-slug }}[bot]
+          RENOVATE_PLATFORM_COMMIT: enabled
diff --git a/README.md b/README.md
index 473632c0..5c77b126 100644
--- a/README.md
+++ b/README.md
@@ -123,6 +123,28 @@ actions/{category}/{action-name}/
 
 ### Development Workflow
 
+#### Dependency Updates
+
+[Dependabot](.github/dependabot.yml) manages dependencies in supported manifests.
+[Renovate](.github/renovate.json) manages the annotated Buildx and BuildKit defaults in
+[Docker Setup](actions/docker/setup/action.yml), using GitHub releases and Docker image tags respectively.
+The [Renovate workflow](.github/workflows/__renovate.yml) runs
+[`renovatebot/github-action`](https://github.com/renovatebot/github-action) every Friday at 04:23 UTC
+and supports manual runs through `workflow_dispatch`. It reads the configuration from the default
+branch and groups updates into pull requests with a minimum release age of seven days.
+Updates require review and CI validation before merging.
+
+The workflow uses the `CI_BOT_APP_CLIENT_ID` variable and `CI_BOT_APP_PRIVATE_KEY` secret
+from the repository or organization. The CI bot must be installed on this repository with
+read access to checks and write access to contents, issues, pull requests, and commit statuses.
+Its installation token is scoped to this repository, and Renovate uses GitHub API commits for signing.
+
+Validate configuration changes with a Node.js version supported by Renovate:
+
+```bash
+npx --yes --package renovate renovate-config-validator --strict --no-global .github/renovate.json
+```
+
 #### Linting & Testing
 
 ```bash
diff --git a/actions/docker/setup/action.yml b/actions/docker/setup/action.yml
index a0cf6a33..e293c152 100644
--- a/actions/docker/setup/action.yml
+++ b/actions/docker/setup/action.yml
@@ -52,16 +52,16 @@ inputs:
       When `DOCKER_HOST` is set, the Docker daemon is managed outside of the runner (e.g. a Docker-in-Docker sidecar) and is kept as is.
     default: "29.7.2"
     required: false
-  # FIXME: upgrade version when available (https://github.com/docker/buildx/releases)
   buildx-version:
     description: |
       Buildx version used by docker/setup-buildx-action.
+    # renovate: datasource=github-releases depName=docker/buildx versioning=semver
     default: "v0.36.1"
     required: false
-  # FIXME: upgrade version when available (https://hub.docker.com/r/moby/buildkit)
   buildkit-image:
     description: |
       BuildKit image used by docker/setup-buildx-action.
+    # renovate: datasource=docker depName=moby/buildkit versioning=docker
     default: "moby/buildkit:v0.32.2"
     required: false