diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 08fb49d7..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  # Weekly checks for updates in Github Actions (CI/CD workflows)
-  - package-ecosystem: 'github-actions'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-      day: monday
-      time: '06:00'
-    groups:
-      ci-cd:
-        patterns:
-          - '*'
-
-  # Weekly checks for pip package updates in build system scripts
-  - package-ecosystem: 'pip'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-      day: monday
-      time: '06:00'
-    groups:
-      build-system:
-        patterns:
-          - '*'
-
-  # Weekly checks for npm package updates in frontend
-  - package-ecosystem: 'npm'
-    directory: '/frontend'
-    schedule:
-      interval: 'weekly'
-      day: monday
-      time: '06:00'
-    groups:
-      frontend:
-        patterns:
-          - '*'
diff --git a/docs/DEVELOPING.md b/docs/DEVELOPING.md
index 95534f7d..0e1238f5 100644
--- a/docs/DEVELOPING.md
+++ b/docs/DEVELOPING.md
@@ -334,7 +334,7 @@ pnpm install
 pnpm run check && pnpm run lint
 ```
 
-Commit `package.json` and `pnpm-lock.yaml`. Dependabot also opens bumps for these.
+Commit `package.json` and `pnpm-lock.yaml`. Renovate also opens bumps for these.
 
 ### FlatBuffers schemas
 
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..3eea7381
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,41 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitTypeAll(chore)",
+    "helpers:pinGitHubActionDigests",
+    "schedule:weekly"
+  ],
+  "minimumReleaseAge": "3 days",
+  "packageRules": [
+    {
+      "description": "One PR for all non-major npm updates",
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "npm non-major"
+    },
+    {
+      "description": "One PR for all non-major Python updates",
+      "matchManagers": ["pip_requirements", "pep621"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "python non-major"
+    },
+    {
+      "description": "One PR for all GitHub Actions updates",
+      "matchManagers": ["github-actions"],
+      "matchDepTypes": ["action"],
+      "groupName": "github-actions"
+    },
+    {
+      "description": "pnpm overrides are security floors for transitive packages, not versions to bump",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["pnpm-workspace.overrides", "pnpm.overrides", "overrides"],
+      "enabled": false
+    },
+    {
+      "description": "Our own packages skip the release-age delay, as in pnpm-workspace.yaml",
+      "matchPackageNames": ["@openshock/**"],
+      "minimumReleaseAge": null
+    }
+  ]
+}
diff --git a/scripts/ci_build_gate.py b/scripts/ci_build_gate.py
index 584148cd..774b8e8a 100644
--- a/scripts/ci_build_gate.py
+++ b/scripts/ci_build_gate.py
@@ -30,7 +30,7 @@
     re.compile(r'(^|/)\.gitkeep$'),
     re.compile(r'^\.claude/'),
     re.compile(r'^\.github/ISSUE_TEMPLATE/'),
-    re.compile(r'^\.github/dependabot\.yml$'),
+    re.compile(r'^renovate\.json$'),
     # Dev-only schema submodule and its codegen helpers; builds use the generated sources.
     re.compile(r'^schemas(/|$)'),
     re.compile(r'^scripts/(fetch_flatc\.py|generate_schemas\.py|flatc|flatc\.exe)$'),
diff --git a/scripts/tests/test_ci_build_gate.py b/scripts/tests/test_ci_build_gate.py
index 0e3e45d2..2066cde6 100644
--- a/scripts/tests/test_ci_build_gate.py
+++ b/scripts/tests/test_ci_build_gate.py
@@ -140,7 +140,7 @@ def test_nightly_with_unchanged_sha_skips():
     '.gitkeep',
     '.claude/settings.json',
     '.github/ISSUE_TEMPLATE/bug_report.yml',
-    '.github/dependabot.yml',
+    'renovate.json',
     'schemas',
     'schemas/HubToGatewayMessage.fbs',
     'scripts/fetch_flatc.py',