diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a67d4bb..cf99d3f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,6 +63,7 @@ jobs:
     env:
       IMPORT_NAME: src_py_lib
       PYTHON_VERSION: "3.11"
+      # renovate: datasource=pypi depName=uv
       UV_VERSION: "0.11.7"
 
     steps:
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index e7ecbbd..76e5d22 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -94,6 +94,7 @@ jobs:
     if: needs.changes.outputs.github_actions == 'true'
     runs-on: ubuntu-24.04
     env:
+      # renovate: datasource=github-releases depName=rhysd/actionlint extractVersion=^v(?<version>.*)$
       ACTIONLINT_VERSION: "1.7.12"
 
     steps:
@@ -126,6 +127,7 @@ jobs:
     if: needs.changes.outputs.markdown == 'true'
     runs-on: ubuntu-24.04
     env:
+      # renovate: datasource=npm depName=markdownlint-cli2
       MARKDOWNLINT_CLI2_VERSION: "0.22.1"
 
     steps:
@@ -152,6 +154,7 @@ jobs:
     env:
       IMPORT_NAME: src_py_lib
       PYTHON_VERSION: "3.11"
+      # renovate: datasource=pypi depName=uv
       UV_VERSION: "0.11.7"
 
     steps:
@@ -215,6 +218,7 @@ jobs:
     env:
       IMPORT_NAME: src_py_lib
       PYTHON_VERSION: "3.11"
+      # renovate: datasource=pypi depName=uv
       UV_VERSION: "0.11.7"
 
     steps:
diff --git a/renovate.json b/renovate.json
index 10d01c0..585dc48 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,8 +1,16 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>sourcegraph/renovate-config"
+    "local>sourcegraph/renovate-config",
+    "customManagers:githubActionsVersions"
   ],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": [
+      "before 4am"
+    ]
+  },
+  "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
       "matchPackageNames": [