diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6ce825c..28043a4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,9 +1,8 @@
 # Dependabot for the CI actions (wslkit/skrog#294).
 #
 # Actions only: this repository is a composite action driving PowerShell, with
-# no package manager and no lockfile. The Skrog version it installs is not a
-# dependency either -- it defaults to "latest" and is resolved from the release
-# API at run time, or pinned by the caller's workflow.
+# no package manager and no lockfile. Renovate manages the action's pinned
+# default Skrog release separately.
 version: 2
 updates:
   - package-ecosystem: github-actions
diff --git a/README.md b/README.md
index dc16030..3b06b9e 100644
--- a/README.md
+++ b/README.md
@@ -6,10 +6,11 @@ against the release's `SHA256SUMS`, and wait for the engine to answer. One line
 replaces Docker Desktop on the runner: no per-runner license, no auto-updates
 you did not schedule, and the same pinned engine your developers run.
 
+<!-- renovate-code-example: datasource=github-releases depName=wslkit/skrog versioning=semver -->
 ```yaml
 - uses: wslkit/setup-skrog@v1
   with:
-    version: 0.3.0            # or omit: "latest"
+    version: 0.10.0
 - run: docker run --rm hello-world
 ```
 
@@ -42,7 +43,7 @@ Self-hosted runners also need a logged-on session for WSL2 — see
 
 | Input | Default | What it does |
 | --- | --- | --- |
-| `version` | `latest` | Skrog release to install, e.g. `0.3.0` |
+| `version` | `0.10.0`<!-- renovate: datasource=github-releases depName=wslkit/skrog versioning=semver --> | Skrog release to install, e.g. `0.10.0` or `latest`. |
 | `lockfile` | `` | Path to a `skrog.lock` (auto-detects `./skrog.lock`) |
 | `install` | `true` | Install and start the engine; `false` stages `skrog.exe` only |
 | `install-args` | `` | Extra `skrog install` arguments |
@@ -75,7 +76,7 @@ same parameters as the inputs above (`-Version`, `-Lockfile`, `-Install`,
 
 ## What the action does, precisely
 
-1. Resolves the release (or uses the pinned version).
+1. Resolves the selected release.
 2. Downloads `skrog_<version>_windows_<arch>.zip` and `SHA256SUMS` from the
    GitHub release and **refuses on any checksum mismatch**.
 3. Extracts, puts `skrog.exe` on `PATH`, exports `SKROG_HOME`.
diff --git a/action.yml b/action.yml
index 69fe468..d13d048 100644
--- a/action.yml
+++ b/action.yml
@@ -10,9 +10,9 @@ branding:
 
 inputs:
   version:
-    description: 'Skrog release to install (e.g. 0.4.1). "latest" resolves the newest release.'
+    description: 'Skrog release to install or "latest".'
     required: false
-    default: 'latest'
+    default: "0.10.0" # renovate: datasource=github-releases depName=wslkit/skrog versioning=semver
   lockfile:
     description: 'Path to a skrog.lock that pins the engine (install --locked). Empty auto-detects ./skrog.lock.'
     required: false
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..97009e1
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,27 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "enabledManagers": ["custom.regex"],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^action\\.ya?ml$/"],
+      "matchStrings": [
+        "default:[ \\t]*[\\\"'`]?(?<currentValue>[^\\s\\\"'`]+)[\\\"'`]?[ \\t]*# renovate: datasource=(?<datasource>github-releases) depName=(?<depName>wslkit/skrog) versioning=(?<versioning>semver)"
+      ]
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^README\\.md$/"],
+      "matchStrings": [
+        "<!-- renovate-code-example: datasource=(?<datasource>github-releases) depName=(?<depName>wslkit/skrog) versioning=(?<versioning>semver) -->[\\s\\S]{0,250}?\\bversion:[ \\t]*[\\\"'`]?(?<currentValue>[^\\s\\\"'`]+)"
+      ]
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^README\\.md$/"],
+      "matchStrings": [
+        "[\\\"'`]?(?<currentValue>[^\\s\\\"'`]+)[\\\"'`]?[ \\t]*<!-- renovate: datasource=(?<datasource>github-releases) depName=(?<depName>wslkit/skrog) versioning=(?<versioning>semver) -->"
+      ]
+    }
+  ]
+}