diff --git a/.github/renovate-bot.json5 b/.github/renovate-bot.json5
new file mode 100644
index 0000000..cf0c46c
--- /dev/null
+++ b/.github/renovate-bot.json5
@@ -0,0 +1,7 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  platform: "github",
+  username: "strg-public-bot[bot]",
+  gitAuthor: "strg-public-bot <174349635+strg-bot[bot]@users.noreply.github.com>",
+  repositories: ["strg-at/containers"],
+}
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..f8b86d2
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,8 @@
+{
+  extends: [
+    "github>strg-at/renovate-config:base.json5",
+    "github>strg-at/renovate-config//github-actions/silent-automerge.json5",
+    "github>strg-at/renovate-config//pre-commit/silent-automerge.json5",
+    "github>strg-at/renovate-config//terraform/silent-automerge.json5",
+  ],
+}
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 0000000..da52809
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,41 @@
+---
+name: renovate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: dry-run
+        required: false
+        type: string
+        default: "false"
+      log-level:
+        description: log-level
+        required: false
+        type: string
+        default: info
+  schedule:
+    - cron: "0 */3 * * 1-4"
+  push:
+    branches:
+      - main
+    paths:
+      - .github/renovate.json5
+      - .github/renovate/**.json5
+      - .github/workflows/renovate.yaml
+
+concurrency:
+  group: renovate
+  cancel-in-progress: true
+
+jobs:
+  renovate:
+    uses: strg-at/github-workflows/.github/workflows/run-renovate.yaml@c3b65900e045c388e6895d74522317427453fde0 # v1.6.1
+    with:
+      runner: '["ubuntu-latest"]'
+      configuration-file: .github/renovate-bot.json5
+      dry-run: ${{ inputs.dry-run || 'false' }}
+      log-level: ${{ inputs.log-level || 'info' }}
+    secrets:
+      github-app-id: ${{ secrets.STRG_PUBLIC_BOT_GITHUB_APP_ID }}
+      github-app-key: ${{ secrets.STRG_PUBLIC_BOT_GITHUB_PEM }}