diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 00000000..a3cc5845
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,54 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: [
+    "config:recommended",
+  ],
+  labels: ["dependencies"],
+  postUpdateOptions: ["gomodTidy"],
+  packageRules: [
+    {
+      // Make sure to update go in the Makefile, go.mod and workflows 
+      groupName: "golang",
+      matchDatasources: ["docker", "golang-version"],
+      matchPackageNames: ["go", "golang"],
+    },
+    {
+      // Make sure the K8s library versions line up. Consciously not scoped to
+      // matchManagers "gomod": controller-tools is pinned in the Makefile and
+      // picked up by the custom manager below, so a gomod scope would leave it
+      // out of the group
+      groupName: "kubernetes",
+      matchPackageNames: [
+        "k8s.io/**",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/controller-tools",
+      ],
+    },
+    {
+      // The zalando postgres-operator is both a go dependency and the source
+      // of the YAML manifests downloaded via the Makefile
+      groupName: "zalando postgres-operator",
+      matchPackageNames: [
+        "github.com/zalando/postgres-operator",
+        "zalando/postgres-operator",
+      ],
+    },
+    {
+      // Combine github actions updates
+      groupName: "github-actions",
+      matchManagers: ["github-actions"],
+    },
+  ],
+  customManagers: [
+    {
+      // Tool versions pinned in the Makefile, annotated with
+      // "# renovate: datasource=... depName=..." right above them.
+      // Stolen from https://docs.renovatebot.com/presets-customManagers/
+      customType: "regex",
+      managerFilePatterns: ["/^Makefile$/"],
+      matchStrings: [
+        "#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s+depName=(?<depName>\\S+)(?:\\s+versioning=(?<versioning>\\S+))?(?:\\s+extractVersion=(?<extractVersion>\\S+))?\\s*\\n\\s*[A-Z_]+\\s*[:?]?=\\s*(?<currentValue>\\S+)",
+      ],
+    },
+  ],
+}
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 00000000..d17b5cb1
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,57 @@
+---
+name: Renovate
+
+on:
+  schedule:
+    # Every day at 04:00 UTC.
+    - cron: '0 4 * * *'
+  push:
+    branches:
+      - feat/renovate
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: 'Renovate log level'
+        required: false
+        default: 'info'
+        type: choice
+        options:
+          - info
+          - debug
+      dryRun:
+        description: 'Run without creating branches, PRs or issues'
+        required: false
+        default: false
+        type: boolean
+
+concurrency:
+  group: renovate
+  cancel-in-progress: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # Only required for testing on push
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Renovate
+        uses: renovatebot/github-action@v46.2.2
+        with:
+          configurationFile: .github/renovate.json5
+          # Needs a PAT (repo + workflow scope) or a GitHub App token, not the
+          # default GITHUB_TOKEN: that one may neither update files below
+          # .github/workflows nor trigger the CI workflows on the PRs it opens.
+          # Currently disabled for testing purposes
+          # token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RENOVATE_ONBOARDING: 'false'
+          RENOVATE_REQUIRE_CONFIG: ${{ github.event_name == 'push' && 'optional' || 'required' }}
+          RENOVATE_BASE_BRANCH_PATTERNS: ${{ github.event_name == 'push' && github.ref_name || '' }}
+          RENOVATE_DRY_RUN: ${{ github.event_name == 'push' && 'full' || (inputs.dryRun && 'full' || 'null') }}
+          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
diff --git a/Makefile b/Makefile
index 8b43f025..cda65b62 100644
--- a/Makefile
+++ b/Makefile
@@ -16,9 +16,11 @@ BUILDDATE := $(shell date -Iseconds)
 VERSION := $(or ${DOCKER_TAG},latest)
 LOCALBIN ?= $(shell pwd)/bin
 CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
+# renovate: datasource=go depName=sigs.k8s.io/controller-tools
 CONTROLLER_TOOLS_VERSION ?= v0.14.0
 
 # Postgres operator variables for YAML download
+# renovate: datasource=github-releases depName=zalando/postgres-operator
 POSTGRES_OPERATOR_VERSION ?= v1.15.1
 POSTGRES_OPERATOR_URL ?= https://raw.githubusercontent.com/zalando/postgres-operator/$(POSTGRES_OPERATOR_VERSION)/manifests
 POSTGRES_CRD_URL ?= https://raw.githubusercontent.com/zalando/postgres-operator/$(POSTGRES_OPERATOR_VERSION)/charts/postgres-operator/crds/postgresqls.yaml
@@ -185,6 +187,7 @@ localkube-install-crd-cwnp:
 crd-cwnp-for-testing:
 	curl https://raw.githubusercontent.com/metal-stack/firewall-controller/master/config/crd/bases/metal-stack.io_clusterwidenetworkpolicies.yaml -o external/test/crd-clusterwidenetworkpolicy.yaml
 
+# renovate: datasource=github-releases depName=kubernetes-sigs/kubebuilder extractVersion=^v(?<version>.*)$
 KUBEBUILDER_VERSION:=3.2.0
 kubebuilder:
 ifeq (,$(wildcard ~/.kubebuilder/${KUBEBUILDER_VERSION}))