diff --git a/ansible/vars.yml b/ansible/vars.yml
index 53a4ae6694..50232d7597 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -37,6 +37,7 @@ adminmgr_artifacts:
   arm64:
     url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/admin-mgr/v{{ adminmgr_release }}/admin-mgr_{{ adminmgr_release }}_linux_arm64.tar.gz"
     checksum: sha256:175a351a394ced27fec9ae8c9289be8f1f0a4c321732b8cbabaa48fa4cba727f
+# renovate: datasource=github-tags packageName=aws/aws-cli
 aws_cli_release: 2.23.11
 aws_cli_artifacts:
   amd64:
@@ -45,6 +46,7 @@ aws_cli_artifacts:
   arm64:
     url: "https://awscli.amazonaws.com/awscli-exe-linux-aarch64-{{ aws_cli_release }}.zip"
     checksum: sha256:21e74a95c28ba2c9a55e6af215484ab4028500c8dc98b7188a2c9854ba116e8f
+# renovate: datasource=github-releases packageName=envoyproxy/envoy
 envoy_release: 1.28.0
 envoy_artifacts:
   amd64:
@@ -56,6 +58,7 @@ envoy_artifacts:
   hot_restarter:
     url: "https://raw.githubusercontent.com/envoyproxy/envoy/v{{ envoy_release }}/restarter/hot-restarter.py"
     checksum: sha256:3a2f9b1056771787eb0304dceb7e42013c6cf1c8e8281ff63f573fa5f258c709
+# renovate: datasource=github-releases packageName=Kong/kong
 kong_release: 2.8.1
 kong_artifacts:
   amd64:
@@ -64,6 +67,7 @@ kong_artifacts:
   arm64:
     url: "https://packages.konghq.com/public/gateway-28/deb/ubuntu/pool/focal/main/k/ko/kong_{{kong_release}}/kong_{{ kong_release }}_arm64.deb"
     checksum: sha256:61c13219ef64dac9aeae5ae775411e8cfcd406f068cf3e75d463f916ae6513cb
+# renovate: datasource=github-releases packageName=supabase/auth
 gotrue_release: 2.197.0
 gotrue_artifacts:
   amd64:
@@ -80,6 +84,7 @@ mint_cli_artifacts:
   arm64:
     url: https://supabase-public-artifacts-bucket.s3.amazonaws.com/mint-cli/v{{ mint_cli_release }}/mint-cli-v{{ mint_cli_release }}-arm64.tar.xz
     checksum: sha256:13040280f8dfe1155b8460d7f35e6a1e04d0167fdf2867678dfb1b117485c581
+# renovate: datasource=github-releases packageName=PostgREST/postgrest
 postgrest_release: "14.18" # keep this as an *explicit* string, otherwise gets treated as yaml float which will likely only lead to tears
 postgrest_artifacts:
   amd64:
@@ -91,6 +96,7 @@ postgrest_artifacts:
   signingkey:
     url: "https://www.postgresql.org/media/keys/ACCC4CF8.asc"
     checksum: sha256:0144068502a1eddd2a0280ede10ef607d1ec592ce819940991203941564e8e76
+# renovate: datasource=github-releases packageName=prometheus-community/postgres_exporter
 postgres_exporter_release: 0.15.0
 postgres_exporter_artifacts:
   amd64:
@@ -99,6 +105,7 @@ postgres_exporter_artifacts:
   arm64:
     url: "https://github.com/prometheus-community/postgres_exporter/releases/download/v{{ postgres_exporter_release }}/postgres_exporter-{{ postgres_exporter_release }}.linux-arm64.tar.gz"
     checksum: sha256:29ba62d538b92d39952afe12ee2e1f4401250d678ff4b354ff2752f4321c87a0
+# renovate: datasource=github-releases packageName=saltstack/salt
 salt_release: "3007.14" # keep this as an *explicit* string, otherwise gets treated as yaml float which will likely only lead to tears
 salt_artifacts:
   url: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
diff --git a/nix/fmt.nix b/nix/fmt.nix
index d10b6ec5a5..ea1d4f2b5d 100644
--- a/nix/fmt.nix
+++ b/nix/fmt.nix
@@ -1,24 +1,30 @@
-{ inputs, ... }:
+{ inputs, lib, ... }:
 {
   imports = [ inputs.treefmt-nix.flakeModule ];
-  perSystem = {
-    treefmt = {
-      programs = {
-        deadnix.enable = true;
-        gofmt.enable = true;
-        nixfmt.enable = true;
-        packer.enable = true;
-        ruff-format.enable = true;
-        shfmt.enable = true;
-        shfmt.indent_size = null; # use shfmt's default width (tab)
-      };
+  perSystem =
+    { config, pkgs, ... }:
+    {
+      treefmt = {
+        programs = {
+          deadnix.enable = true;
+          gofmt.enable = true;
+          nixfmt.enable = true;
+          packer.enable = true;
+          ruff-format.enable = true;
+          shfmt.enable = true;
+          shfmt.indent_size = null; # use shfmt's default width (tab)
+        };
 
-      settings = {
-        global.excludes = [
-          "*.sum"
-          "vendor/*"
-        ];
+        settings = {
+          formatter.oxfmt = {
+            command =
+              assert lib.assertMsg (
+                !(config.treefmt.programs ? oxfmt)
+              ) "treefmt-nix now has an oxfmt module; replace this formatter with programs.oxfmt";
+              "${pkgs.oxfmt}/bin/oxfmt";
+            includes = [ "renovate.json5" ];
+          };
+        };
       };
     };
-  };
 }
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
index c4622d4606..eec437c556 100644
--- a/nix/nixpkgs.nix
+++ b/nix/nixpkgs.nix
@@ -18,6 +18,7 @@
           (
             final: prev:
             let
+              # renovate: datasource=github-tags packageName=eggert/tz
               version = "2026f";
             in
             {
diff --git a/renovate.json5 b/renovate.json5
new file mode 100644
index 0000000000..0decf999a7
--- /dev/null
+++ b/renovate.json5
@@ -0,0 +1,74 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended", "security:only-security-updates"],
+  customManagers: [
+    {
+      customType: "regex",
+      depNameTemplate: "tzdata",
+      description: "tzdata override version in nix/nixpkgs.nix annotated with a '# renovate:' comment",
+      managerFilePatterns: ["/^nix/nixpkgs\\.nix$/"],
+      matchStrings: [
+        '# renovate: datasource=(?<datasource>\\S+) packageName=(?<packageName>\\S+)\\n\\s*version = "(?<currentValue>[^"]+)";',
+      ],
+    },
+    {
+      customType: "regex",
+      description: "Versions in ansible/vars.yml annotated with a '# renovate:' comment",
+      extractVersionTemplate: "^v?(?<version>.+)$",
+      managerFilePatterns: ["/^ansible/vars\\.yml$/"],
+      matchStrings: [
+        '# renovate: datasource=(?<datasource>\\S+) packageName=(?<packageName>\\S+)\\n(?<depName>\\w+)_release: "?(?<currentValue>[^"\\s#]+)"?',
+      ],
+    },
+  ],
+  packageRules: [
+    {
+      allowedVersions: "/^2\\./",
+      description: "Only the v2 line of the AWS CLI is installed",
+      matchDepNames: ["aws_cli"],
+      matchFileNames: ["ansible/vars.yml"],
+    },
+    {
+      allowedVersions: "/^2\\.8\\./",
+      description: "Kong download URLs are pinned to the gateway-28 (2.8.x) repo",
+      matchDepNames: ["kong"],
+      matchFileNames: ["ansible/vars.yml"],
+    },
+    {
+      allowedVersions: "/^3007\\./",
+      description: "Salt ships security releases in minor updates and does not do micro/patch. Stay on the 3007 major.",
+      enabled: true,
+      matchDepNames: ["salt"],
+      matchFileNames: ["ansible/vars.yml"],
+    },
+    {
+      description: "tzdata overlay in nix/nixpkgs.nix: allow regular updates and refresh the tarball hashes",
+      enabled: true,
+      matchDepNames: ["tzdata"],
+      matchFileNames: ["nix/nixpkgs.nix"],
+      postUpgradeTasks: {
+        commands: [
+          'for k in tzdata tzcode; do h=$(nix store prefetch-file --json https://data.iana.org/time-zones/releases/${k}{{{newVersion}}}.tar.gz | jq -r .hash); sed -i "/releases\\/${k}\\${version}/{n;s|hash = \\".*\\"|hash = \\"$h\\"|}" nix/nixpkgs.nix; done',
+        ],
+        executionMode: "update",
+        fileFilters: ["nix/nixpkgs.nix"],
+      },
+    },
+    {
+      description: "ansible/vars.yml artifacts: allow regular (non-security) updates and refresh checksums",
+      enabled: true,
+      matchFileNames: ["ansible/vars.yml"],
+      postUpgradeTasks: {
+        commands: ["nix run .#update-ansible-artifacts -- {{{depName}}} {{{newVersion}}}"],
+        executionMode: "update",
+        fileFilters: ["ansible/vars.yml"],
+      },
+    },
+    {
+      description: "GitHub Actions: regular updates after a cool-off (pins are tracked in .github/workflows/actions.lock)",
+      enabled: true,
+      matchManagers: ["github-actions"],
+      minimumReleaseAge: "7 days",
+    },
+  ],
+}