diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..0990b4c
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,5 @@
+{
+  extends: [
+    "github>coreweave/renovate-config"
+  ],
+}
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 0000000..82972de
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,64 @@
+---
+  # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+  name: "Renovate"
+
+  on:
+    workflow_dispatch:
+      inputs:
+        dryRun:
+          description: Dry Run
+          default: "false"
+          required: false
+        logLevel:
+          description: Log Level
+          default: debug
+          required: false
+        version:
+          description: Renovate version
+          default: latest
+          required: false
+    schedule:
+      - cron: "0 * * * *" # Every hour
+    push:
+      branches: ["develop"]
+      paths:
+        - .github/renovate.json5
+        - .github/renovate/**.json5
+
+  concurrency:
+    group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+    cancel-in-progress: true
+
+  env:
+    LOG_LEVEL: "${{ inputs.logLevel || 'debug' }}"
+    RENOVATE_AUTODISCOVER: true
+    RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
+    RENOVATE_DRY_RUN: "${{ inputs.dryRun == true }}"
+    RENOVATE_PLATFORM: github
+    RENOVATE_PLATFORM_COMMIT: true
+    WORKFLOW_RENOVATE_VERSION: "${{ inputs.version || 'latest' }}"
+
+  jobs:
+    renovate:
+      name: Renovate
+      runs-on: ubuntu-latest
+      steps:
+        - name: Generate Token
+          uses: actions/create-github-app-token@v1
+          id: app-token
+          with:
+            app-id: "${{ secrets.ORG_RENOVATE_CLIENTID }}"
+            private-key: "${{ secrets.ORG_RENOVATE_PRIVATEKEY }}"
+            owner: "${{ github.repository_owner }}"
+
+        - name: Checkout
+          uses: actions/checkout@v4
+          with:
+            token: "${{ steps.app-token.outputs.token }}"
+
+        - name: Renovate
+          uses: renovatebot/github-action@v40.1.12
+          with:
+            configurationFile: .github/renovate.json5
+            token: "${{ steps.app-token.outputs.token }}"
+            renovate-version: "${{ env.WORKFLOW_RENOVATE_VERSION }}"
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f500688..4c24b00 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -13,6 +13,7 @@ workflow:
       when: always
 
 variables:
+  # renovate: depName=ghcr.io/tailscale/tailscale datasource=docker
   RELEASE_VERSION: "1.68.0"
   REF_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
   FIXED_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
diff --git a/chart/tailscale-derp/Chart.yaml b/chart/tailscale-derp/Chart.yaml
index 25003fd..bf22f3d 100644
--- a/chart/tailscale-derp/Chart.yaml
+++ b/chart/tailscale-derp/Chart.yaml
@@ -21,4 +21,5 @@ version: 0.1.0
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
+# renovate: depName=registry.gitlab.com/coreweave/tailscale-derp datasource=docker
 appVersion: "v1.68.0"