diff --git a/.github/chainguard/renovate.sts.yaml b/.github/chainguard/renovate.sts.yaml
new file mode 100644
index 0000000..3116f32
--- /dev/null
+++ b/.github/chainguard/renovate.sts.yaml
@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+subject: repo:btolab/colima-core:ref:refs/heads/main
+
+permissions:
+  checks: write
+  contents: write
+  issues: write
+  members: read
+  pull_requests: write
+  statuses: write
+  workflows: write
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000..61fe835
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,52 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    "helpers:pinGitHubActionDigestsToSemver"
+  ],
+  "minimumReleaseAge": "1 day",
+  "prHourlyLimit": 0,
+  "automergeType": "pr",
+  "packageRules": [
+    {
+      "description": "Automerge safe updates (patch) plus digest updates once checks pass",
+      "matchUpdateTypes": ["patch", "digest"],
+      "automerge": true
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^dependencies\\.env$"],
+      "matchStrings": ["DOCKER_VERSION=\"(?<currentValue>[^\"]+)\""],
+      "depNameTemplate": "moby/moby",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.+)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^dependencies\\.env$"],
+      "matchStrings": ["NERDCTL_VERSION=\"(?<currentValue>[^\"]+)\""],
+      "depNameTemplate": "containerd/nerdctl",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.+)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^dependencies\\.env$"],
+      "matchStrings": ["FLANNEL_VERSION=\"(?<currentValue>[^\"]+)\""],
+      "depNameTemplate": "flannel-io/cni-plugin",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.+)$",
+      "versioningTemplate": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-flannel(?<build>\\d+)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^dependencies\\.env$"],
+      "matchStrings": ["BINFMT_VERSION=\"(?<currentValue>[^\"]+)\""],
+      "depNameTemplate": "tonistiigi/binfmt",
+      "datasourceTemplate": "github-tags",
+      "versioningTemplate": "regex:^deploy/v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-(?<build>\\d+)$"
+    }
+  ]
+}
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
new file mode 100644
index 0000000..a4813a1
--- /dev/null
+++ b/.github/workflows/renovate.yml
@@ -0,0 +1,36 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        id: octo-sts
+        with:
+          scope: ${{ github.repository }}
+          identity: renovate
+
+      - uses: renovatebot/github-action@v46.1.16
+        with:
+          configurationFile: .github/renovate.json
+        env:
+          RENOVATE_TOKEN: ${{ steps.octo-sts.outputs.token }}
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
diff --git a/Makefile b/Makefile
index c38eba1..6c7a81e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,7 @@
 # image and tool versions
 include dependencies.env
+FLANNEL_MINI_VERSION = $(shell echo "$(FLANNEL_VERSION)" | sed 's/-flannel[0-9]*//')
+BINFMT_QEMU_VERSION = $(shell echo "$(BINFMT_VERSION)" | sed 's|deploy/v||;s/-[0-9]*$$//')
 
 # runtime
 RUNTIME ?= docker
diff --git a/dependencies.env b/dependencies.env
index 9572740..435cf75 100644
--- a/dependencies.env
+++ b/dependencies.env
@@ -1,8 +1,6 @@
 UBUNTU_VERSION="24.04"
 UBUNTU_CODENAME="noble"
-BINFMT_VERSION="deploy/v7.0.0-28"
-BINFMT_QEMU_VERSION="7.0.0"
+BINFMT_VERSION="deploy/v10.2.3-68"
 DOCKER_VERSION="29.5.2"
 NERDCTL_VERSION="2.3.1"
 FLANNEL_VERSION="1.9.1-flannel1"
-FLANNEL_MINI_VERSION="1.9.1"