diff --git a/.github/renovate-config.json b/.github/renovate-config.json
new file mode 100644
index 0000000..29cd51d
--- /dev/null
+++ b/.github/renovate-config.json
@@ -0,0 +1,45 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "onboarding": false,
+  "requireConfig": "optional",
+  "enabledManagers": ["custom.regex"],
+  "schedule": ["before 4am on monday"],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "shellcheck version pinned in ci.yml (checksum needs a manual refresh; CI fails loudly if it's stale)",
+      "managerFilePatterns": [".github/workflows/ci.yml"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+SHELLCHECK_VERSION: (?<currentValue>\\S+)"
+      ]
+    },
+    {
+      "customType": "regex",
+      "description": "rubyfmt version pinned in support/latest (checksums need a manual refresh via support/sync-versions.sh; CI fails loudly if stale)",
+      "managerFilePatterns": ["support/latest"],
+      "matchStrings": ["(?<currentValue>\\S+)"],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "fables-tales/rubyfmt",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "description": "actionlint download script, SHA-pinned with a version comment in ci.yml (same convention as our uses:@sha # vX.Y.Z action pins)",
+      "managerFilePatterns": [".github/workflows/ci.yml"],
+      "matchStrings": [
+        "raw\\.githubusercontent\\.com/rhysd/actionlint/(?<currentDigest>[a-f0-9]{40})/scripts/download-actionlint\\.bash\"\\) # (?<currentValue>v\\d+\\.\\d+\\.\\d+)"
+      ],
+      "datasourceTemplate": "github-tags",
+      "depNameTemplate": "rhysd/actionlint"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchDepNames": ["koalaman/shellcheck", "fables-tales/rubyfmt"],
+      "prBodyNotes": [
+        "This bumps a version pin only. The checksum(s) in this file were **not** updated automatically — CI will fail with a checksum mismatch until they're refreshed. For `fables-tales/rubyfmt`, run `support/sync-versions.sh <tag>`. For `koalaman/shellcheck`, recompute the sha256 of the new release's `shellcheck-<version>.linux.x86_64.tar.xz` asset and update `SHELLCHECK_SHA256` in `.github/workflows/ci.yml`."
+      ]
+    }
+  ]
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 03e883e..1e89ac6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,10 @@ permissions: {}
 jobs:
   lint:
     runs-on: ubuntu-latest
+    env:
+      # renovate: datasource=github-releases depName=koalaman/shellcheck
+      SHELLCHECK_VERSION: v0.11.0
+      SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -20,17 +24,17 @@ jobs:
       - name: Download shellcheck
         run: |
           curl --fail --silent --show-error --location --output /tmp/shellcheck.tar.xz \
-            "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz"
-          echo "8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198  /tmp/shellcheck.tar.xz" | sha256sum -c -
+            "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
+          echo "${SHELLCHECK_SHA256}  /tmp/shellcheck.tar.xz" | sha256sum -c -
           tar --extract --xz --file /tmp/shellcheck.tar.xz --directory /tmp
         shell: bash
 
       - name: Shellcheck
-        run: find . -type f -name "*.sh" -print0 | xargs -0 /tmp/shellcheck-v0.11.0/shellcheck
+        run: find . -type f -name "*.sh" -print0 | xargs -0 "/tmp/shellcheck-${SHELLCHECK_VERSION}/shellcheck"
         shell: bash
 
       - name: Download actionlint
-        run: bash <(curl --fail --silent --show-error --location "https://raw.githubusercontent.com/rhysd/actionlint/011a6d15e749bb3f2d771eed9c7aa0e7e3e10ee7/scripts/download-actionlint.bash")
+        run: bash <(curl --fail --silent --show-error --location "https://raw.githubusercontent.com/rhysd/actionlint/914e7df21a07ef503a81201c76d2b11c789d3fca/scripts/download-actionlint.bash") # v1.7.12
         shell: bash
 
       - name: actionlint
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
new file mode 100644
index 0000000..daf79c1
--- /dev/null
+++ b/.github/workflows/renovate.yml
@@ -0,0 +1,29 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 4 * * 1"
+  workflow_dispatch: {}
+
+permissions: {}
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@39b914146caeff8cd512e61c8992f1d5913af85c # v46.2.5
+        env:
+          RENOVATE_PLATFORM: github
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+        with:
+          configurationFile: .github/renovate-config.json
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/README.md b/README.md
index 99ac16f..972ae56 100644
--- a/README.md
+++ b/README.md
@@ -125,6 +125,17 @@ This downloads each platform's release asset, records its checksum in
 [`support/latest`](support/latest). Pass `--historical` to pin an older
 release without changing what `latest` resolves to.
 
+A self-hosted [Renovate](https://github.com/rubyatscale/rubyfmt-action/blob/main/.github/workflows/renovate.yml)
+job runs weekly and opens a PR bumping [`support/latest`](support/latest)
+when a new `rubyfmt` release is available, and similarly for the `shellcheck`
+version pinned in [`ci.yml`](.github/workflows/ci.yml). Neither of those PRs
+update the corresponding checksum(s) automatically (there's nothing for
+Renovate to safely fetch a checksum from), so CI on those PRs fails until the
+checksum is refreshed — run `support/sync-versions.sh <tag>` for `rubyfmt`,
+or manually recompute and update `SHELLCHECK_SHA256` for `shellcheck`.
+Dependabot (see [`dependabot.yml`](.github/dependabot.yml)) separately
+handles the rest of this repo's GitHub Actions dependencies.
+
 ## License
 
 This project is licensed under the MIT License. See [LICENSE](LICENSE) for