diff --git a/mise.lock b/mise.lock
index bc16efa..57dd62a 100644
--- a/mise.lock
+++ b/mise.lock
@@ -106,7 +106,7 @@ checksum = "sha256:ec56b84a7551893ab2324ebdfdc4ab974a63b4781162600b68a1293cc3e53
 url = "https://nodejs.org/dist/v24.18.1/node-v24.18.1-win-x64.zip"
 
 [[tools."npm:renovate"]]
-version = "43.265.1"
+version = "43.288.0"
 backend = "npm:renovate"
 
 [[tools.pkl]]
diff --git a/mise.toml b/mise.toml
index e8d33d0..bac935c 100644
--- a/mise.toml
+++ b/mise.toml
@@ -43,7 +43,7 @@ run_windows = "pnpm install --frozen-lockfile"
 actionlint = "1.7.12"
 hk = "1.53.0"
 node = "24.18.1"
-"npm:renovate" = "43.265.1"
+"npm:renovate" = "43.288.0"
 pkl = "0.32.1"
 # Deliberately duplicates `packageManager` in package.json (turbo requires
 # that field). Renovate groups both bumps into one PR — see the "pnpm"