diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 9adfb49..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: maven
-    directory: "/"
-    schedule:
-      interval: weekly
-    groups:
-      maven-minor-and-patch:
-        update-types: [minor, patch]
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
new file mode 100644
index 0000000..2d9ca8c
--- /dev/null
+++ b/.github/workflows/renovate.yml
@@ -0,0 +1,53 @@
+name: Renovate
+
+# Deterministic dependency-update PRs (same pattern as Lou-Lou-CH/lou-lou and
+# sobatista-vulnerable-apis/base-project). Policy lives in the shared preset this
+# repo's renovate.json extends; repo-specific scope lives in renovate.json itself.
+#
+# Uses a PAT (RENOVATE_TOKEN), not GITHUB_TOKEN, so the PRs it opens trigger this
+# repo's own CI like any other PR (GITHUB_TOKEN-authored PRs do not trigger
+# workflows). Without the secret the job is a no-op notice, never a failure.
+#
+# Runs every 6 hours so security PRs (vulnerabilityAlerts, "at any time") are not
+# held back a week and green automerge-eligible PRs merge on the next pass; routine
+# PRs are still limited to the Monday-morning window by the preset's `schedule`.
+
+on:
+  schedule:
+    - cron: '17 */6 * * *'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+# One run at a time; a manual run waits for the scheduled one instead of racing it.
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check for RENOVATE_TOKEN
+        id: check
+        env:
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+        run: |
+          if [ -n "$RENOVATE_TOKEN" ]; then
+            echo "has_token=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::RENOVATE_TOKEN not set, skipping. Needs a fine-grained PAT on this repo with contents, pull-requests, issues, workflows and commit-statuses write, plus Dependabot alerts read."
+            echo "has_token=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: renovatebot/github-action@e09d604f8f803bb527bd8321ed5be06c460b8682 # v46.2.2
+        if: steps.check.outputs.has_token == 'true'
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_ONBOARDING: 'false'
+          RENOVATE_REQUIRE_CONFIG: required
+          LOG_LEVEL: info
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f573e73..38370ff 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ All notable changes to Agon are documented here. The format follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Changed
+- Dependency updates move from Dependabot to self-hosted Renovate (`renovate.json`, weekly grouped PRs; GitHub Dependabot
+  security alerts stay on).
 
 ## [0.1.0] - 2026-10-15
 ### Added
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..f638f62
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>MRegra/fedora-workstation-scripts//renovate/default"],
+  "description": [
+    "Scope mirrors the Dependabot config this replaces: Maven (root pom drives every module) and GitHub Actions."
+  ],
+  "enabledManagers": ["maven", "github-actions"]
+}