diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 4b6ea5cd..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  # Check for Nuget package updates
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: '10:00'
-    groups:
-      npm:
-        patterns:
-          - '*' # Group all updates together
-
-  # Check for Github Actions version updates (for CI/CD)
-  - package-ecosystem: github-actions
-    directories:
-      - /
-      - /.github/actions/* # composite actions are not covered by `/`
-    schedule:
-      interval: weekly
-      day: monday
-      time: '10:00'
-    groups:
-      github-actions:
-        patterns:
-          - '*' # Group all updates together
diff --git a/.github/workflows/update-toolchain.yml b/.github/workflows/update-toolchain.yml
index 1174eff8..b7754c1d 100644
--- a/.github/workflows/update-toolchain.yml
+++ b/.github/workflows/update-toolchain.yml
@@ -1,6 +1,6 @@
 on:
   schedule:
-    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC — matches dependabot.yml's cadence
+    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC — same day as Renovate's weekly schedule
   workflow_dispatch: # Manually invoked by user.
 
 name: update-toolchain
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..7bd50aee
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,46 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitTypeAll(chore)",
+    "helpers:pinGitHubActionDigests",
+    "schedule:weekly"
+  ],
+  "minimumReleaseAge": "3 days",
+  "packageRules": [
+    {
+      "description": "One PR for all non-major npm updates",
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "npm non-major"
+    },
+    {
+      "description": "One PR for all GitHub Actions updates",
+      "matchManagers": ["github-actions"],
+      "matchDepTypes": ["action"],
+      "groupName": "github-actions"
+    },
+    {
+      "description": "pnpm overrides are security floors for transitive packages, not versions to bump",
+      "matchManagers": ["npm"],
+      "matchDepTypes": ["pnpm-workspace.overrides", "pnpm.overrides", "overrides"],
+      "enabled": false
+    },
+    {
+      "description": "Our own packages skip the release-age delay, as in pnpm-workspace.yaml",
+      "matchPackageNames": ["@openshock/**"],
+      "minimumReleaseAge": null
+    },
+    {
+      "description": "The pnpm patch is keyed to an exact SignalR version, so bumps need the patch refreshed by hand",
+      "matchPackageNames": ["@microsoft/signalr"],
+      "groupName": null
+    },
+    {
+      "description": "Node, pnpm and the base image are bumped together by .github/workflows/update-toolchain.yml",
+      "matchFileNames": [".nvmrc", "Dockerfile", "package.json"],
+      "matchDepNames": ["node", "pnpm"],
+      "enabled": false
+    }
+  ]
+}