diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
deleted file mode 100644
index 98824083..00000000
--- a/.github/dependabot.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  - package-ecosystem: "gomod" # See documentation for possible values
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "daily"
\ No newline at end of file
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 00000000..05259201
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,59 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: [
+    "config:recommended",
+  ],
+  // We define a wider Kubernetes group below. Excluding Renovate's built-in
+  // Kubernetes monorepo group prevents the same update from being assigned to
+  // both groups and producing overlapping branches/PRs.
+  ignorePresets: ["group:kubernetesMonorepo"],
+  labels: ["dependencies"],
+  postUpdateOptions: ["gomodTidy"],
+  packageRules: [
+    {
+      // Make sure to update go in the Makefile, go.mod and workflows 
+      groupName: "golang",
+      matchDatasources: ["docker", "golang-version"],
+      matchPackageNames: ["go", "golang"],
+    },
+    {
+      // Keep the K8s library versions aligned. Consciously not scoped to
+      // matchManagers "gomod": controller-tools is pinned in the Makefile and
+      // picked up by the custom manager below, so a gomod scope would leave it
+      // out of the group.
+      groupName: "kubernetes",
+      groupSlug: "kubernetes",
+      matchPackageNames: [
+        "k8s.io/**",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/controller-tools",
+      ],
+    },
+    {
+      // The zalando postgres-operator is both a go dependency and the source
+      // of the YAML manifests downloaded via the Makefile
+      groupName: "zalando postgres-operator",
+      matchPackageNames: [
+        "github.com/zalando/postgres-operator",
+        "zalando/postgres-operator",
+      ],
+    },
+    {
+      // Combine github actions updates
+      groupName: "github-actions",
+      matchManagers: ["github-actions"],
+    },
+  ],
+  customManagers: [
+    {
+      // Tool versions pinned in the Makefile, annotated with
+      // "# renovate: datasource=... depName=..." right above them.
+      // Stolen from https://docs.renovatebot.com/presets-customManagers/
+      customType: "regex",
+      managerFilePatterns: ["/^Makefile$/"],
+      matchStrings: [
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?(?:\\s+extractVersion=(?<extractVersion>\\S+))?\\s*\\n\\s*[A-Z_]+\\s*[:?]?=\\s*(?<currentValue>\\S+)",
+      ],
+    },
+  ],
+}
diff --git a/.github/workflows/latest.yaml b/.github/workflows/latest.yaml
index 524d579f..34276ef4 100644
--- a/.github/workflows/latest.yaml
+++ b/.github/workflows/latest.yaml
@@ -20,7 +20,7 @@ jobs:
         password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
 
     - name: Ensure Go Version
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v5
       with:
         go-version-file: 'go.mod'
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3110ea38..a1ed861b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Docker Login
       uses: docker/login-action@v3
@@ -21,7 +21,7 @@ jobs:
 
 
     - name: Ensure Go Version
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v5
       with:
         go-version-file: 'go.mod'
   
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 00000000..edb588a7
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,52 @@
+---
+name: Renovate
+
+on:
+  schedule:
+    # Every day at 04:00 UTC.
+    - cron: '0 4 * * *'
+  push:
+    branches:
+      - feat/renovate
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: 'Renovate log level'
+        required: false
+        default: 'info'
+        type: choice
+        options:
+          - info
+          - debug
+
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Get token
+        id: get_token
+        uses: actions/create-github-app-token@v1
+        with:
+          private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
+          app-id: ${{ secrets.RENOVATE_APP_CLIENT_ID }}
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Renovate
+        uses: renovatebot/github-action@v46.2.2
+        with:
+          configurationFile: .github/renovate.json5
+          token: '${{ steps.get_token.outputs.token }}'
+        env:
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_ONBOARDING: 'false'
+          RENOVATE_REQUIRE_CONFIG: ${{ github.event_name == 'push' && 'optional' || 'required' }}
+          RENOVATE_BASE_BRANCH_PATTERNS: ${{ github.ref_name }}
+          RENOVATE_DRY_RUN: 'full'
+          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
diff --git a/Makefile b/Makefile
index 729b5e1a..8884dc89 100644
--- a/Makefile
+++ b/Makefile
@@ -16,9 +16,11 @@ BUILDDATE := $(shell date -Iseconds)
 VERSION := $(or ${DOCKER_TAG},latest)
 LOCALBIN ?= $(shell pwd)/bin
 CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
+# renovate: datasource=go depName=sigs.k8s.io/controller-tools
 CONTROLLER_TOOLS_VERSION ?= v0.21.0
 
 # Postgres operator variables for YAML download
+# renovate: datasource=github-releases depName=zalando/postgres-operator
 POSTGRES_OPERATOR_VERSION ?= v2.0.2
 POSTGRES_OPERATOR_URL ?= https://raw.githubusercontent.com/zalando/postgres-operator/$(POSTGRES_OPERATOR_VERSION)/manifests
 POSTGRES_CRD_URL ?= https://raw.githubusercontent.com/zalando/postgres-operator/$(POSTGRES_OPERATOR_VERSION)/charts/postgres-operator/crds/postgresqls.yaml
@@ -186,6 +188,7 @@ localkube-install-crd-cwnp:
 crd-cwnp-for-testing:
 	curl https://raw.githubusercontent.com/metal-stack/firewall-controller/master/config/crd/bases/metal-stack.io_clusterwidenetworkpolicies.yaml -o external/test/crd-clusterwidenetworkpolicy.yaml
 
+# renovate: datasource=github-releases depName=kubernetes-sigs/kubebuilder extractVersion=^v(?<version>.*)$
 KUBEBUILDER_VERSION:=3.2.0
 kubebuilder:
 ifeq (,$(wildcard ~/.kubebuilder/${KUBEBUILDER_VERSION}))