diff --git a/.github/renovate-file-config.js b/.github/renovate-file-config.js
new file mode 100644
index 0000000..78f4d65
--- /dev/null
+++ b/.github/renovate-file-config.js
@@ -0,0 +1,41 @@
+const extraLookupToken = process.env.RENOVATE_EXTRA_LOOKUP_TOKEN;
+const extraLookupOwner = (process.env.RENOVATE_EXTRA_LOOKUP_OWNER || '').trim();
+
+// RENOVATE_EXTRA_LOOKUP_REPOSITORIES is newline-separated; be liberal about
+// whitespace/commas, and tolerate "owner/repo" as well as a bare "repo".
+const extraLookupRepositories = (process.env.RENOVATE_EXTRA_LOOKUP_REPOSITORIES || '')
+    .split(/[\s,]+/)
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .map((entry) => entry.split('/').filter(Boolean).pop())
+    .filter(Boolean);
+
+const extraLookupHostRules = [];
+
+if (extraLookupToken && extraLookupOwner && extraLookupRepositories.length > 0) {
+    for (const repository of extraLookupRepositories) {
+        const slug = `${extraLookupOwner}/${repository}`;
+        // Renovate matches URL-form matchHost with a case-sensitive startsWith(),
+        // and the request URL case comes from how the consumer wrote the dependency
+        // reference. Emit both the canonical-case and the lower-case variant.
+        for (const variant of new Set([slug, slug.toLowerCase()])) {
+            extraLookupHostRules.push({
+                hostType: 'github',
+                matchHost: `https://api.github.com/repos/${variant}`,
+                token: extraLookupToken,
+            });
+        }
+    }
+}
+
+module.exports = {
+    "autodiscover": true,
+    "hostRules": [
+        {
+            hostType: 'github',
+            matchHost: 'https://api.github.com/repos/rtbhouse-platform-engineering/renovate-scanner',
+            token: process.env.RENOVATE_CONFIG_PRESET_TOKEN,
+        },
+        ...extraLookupHostRules,
+    ],
+};
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..608be07
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,6 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>rtbhouse-platform-engineering/renovate-scanner//renovate/default.json5"
+  ]
+}
diff --git a/.github/workflows/automated-dependency-updates.yaml b/.github/workflows/automated-dependency-updates.yaml
new file mode 100644
index 0000000..8080712
--- /dev/null
+++ b/.github/workflows/automated-dependency-updates.yaml
@@ -0,0 +1,19 @@
+name: Automated dependency updates
+on:
+  schedule:
+    - cron: "0 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    name: Renovate
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: rtbhouse-platform-engineering/renovate-scanner/.github/actions/run-renovate@474d3c935be08e8f838961ef759fae98c1d2212b # v0.3.2
+        with:
+          gh-renovate-config-preset-app-id: ${{ vars.GH_READER_APP_ID }}
+          gh-renovate-config-preset-app-private-key: ${{ secrets.GH_READER_APP_PRIVATE_KEY }}
+          gh-renovate-app-id: ${{ vars.GH_RENOVATE_APP_ID }}
+          gh-renovate-app-private-key: ${{ secrets.GH_RENOVATE_APP_PRIVATE_KEY }}
+          extra-lookup-repositories: ${{ vars.RENOVATE_EXTRA_LOOKUP_REPOSITORIES }}