diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index c20dd03..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-version: 2
-updates:
-  # JS dependencies (Dependabot's "npm" ecosystem understands the pnpm lockfile)
-  - package-ecosystem: 'npm'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-    open-pull-requests-limit: 10
-    groups:
-      # batch low-risk updates into single PRs
-      dev-dependencies:
-        dependency-type: 'development'
-        update-types: ['minor', 'patch']
-      production-dependencies:
-        dependency-type: 'production'
-        update-types: ['minor', 'patch']
-
-  # GitHub Actions used in workflows
-  - package-ecosystem: 'github-actions'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
diff --git a/package.json b/package.json
index d08bcfb..760318e 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "description": "A browser-based 3D synthwave kart racer (Three.js + Vite).",
   "license": "MIT",
   "type": "module",
-  "packageManager": "pnpm@11.2.2",
+  "packageManager": "pnpm@11.28.6",
   "engines": {
     "node": ">=26",
     "pnpm": ">=11"
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..1cde699
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,39 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Managed from pacphi/mise-dotfiles. Replaces Dependabot version updates (2026-10-21).",
+  "extends": ["config:recommended"],
+  "minimumReleaseAge": "3 days",
+  "internalChecksFilter": "strict",
+  "osvVulnerabilityAlerts": true,
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security"]
+  },
+  "packageRules": [
+    {
+      "description": "npm: settings",
+      "matchCategories": ["js"],
+      "schedule": ["* 0-5 * * 1"]
+    },
+    {
+      "description": "npm: group dev-dependencies",
+      "matchCategories": ["js"],
+      "groupName": "dev-dependencies",
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchDepTypes": ["devDependencies"]
+    },
+    {
+      "description": "npm: group production-dependencies",
+      "matchCategories": ["js"],
+      "groupName": "production-dependencies",
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchDepTypes": ["dependencies"]
+    },
+    {
+      "description": "github-actions: settings",
+      "matchCategories": ["ci"],
+      "schedule": ["* 0-5 * * 1"]
+    }
+  ],
+  "prConcurrentLimit": 10
+}