diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index df20df0..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1
-
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: gradle
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: pip
-    directory: /
-    schedule:
-      interval: weekly
-
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..37fa078
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+// SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1
+
+// Renovate proposes the version updates of this repository. Dependabot keeps
+// its alerts and its security updates, which are repository settings; its
+// version updates are off, so that two bots do not open the same pull
+// request.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended", "helpers:pinGitHubActionDigests"],
+
+  timezone: "Europe/Istanbul",
+  // Once a week, before the working day.
+  schedule: ["before 6am on monday"],
+
+  // A release is taken a week after it is published: one that turns out to
+  // be broken or malicious is usually withdrawn within days.
+  minimumReleaseAge: "7 days",
+
+  // A pull request is rebased when it conflicts, not whenever the default
+  // branch moves, so that a merge does not start the tests of every open
+  // update again.
+  rebaseWhen: "conflicted",
+  prConcurrentLimit: 2,
+  prHourlyLimit: 2,
+
+  // One issue lists what is pending, so an update need not be a pull request
+  // to be seen.
+  dependencyDashboard: true,
+
+  // Security fixes come from Dependabot security updates. Renovate does not
+  // open its own for the same advisory.
+  vulnerabilityAlerts: { enabled: false },
+
+  ignorePaths: ["legacy/**", "third_party/**", "**/node_modules/**"],
+
+  // What Dependabot watched here, and nothing more for now.
+  enabledManagers: ["github-actions", "gradle", "gradle-wrapper", "pip_requirements"],
+
+  // One pull request for each kind of dependency.
+  packageRules: [
+    { matchManagers: ["github-actions"], groupName: "GitHub Actions" },
+    { matchManagers: ["gradle", "gradle-wrapper"], groupName: "Gradle plugins and libraries" },
+    { matchManagers: ["pip_requirements"], groupName: "Python tools of CI" },
+  ],
+}
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 83ac0c5..ea2f2cf 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -5,7 +5,7 @@ name: Dependency Review
 
 # Looks at the dependencies a pull request adds or changes, and fails when
 # one of them has a known vulnerability of high severity or worse.
-# Dependabot watches what is already there; this holds what comes in.
+# Dependabot alerts report what is already there; this holds what comes in.
 
 on:
   pull_request: