diff --git a/.github/renovate-config.js b/.github/renovate-config.js
new file mode 100644
index 000000000..b589799da
--- /dev/null
+++ b/.github/renovate-config.js
@@ -0,0 +1,57 @@
+"use strict";
+// https://github.com/renovatebot/github-action/blob/main/.github/renovate.json
+// https://docs.renovatebot.com/configuration-options/
+
+module.exports = {
+	"extends": [":disableRateLimiting", ":semanticCommits"],
+	"assigneesFromCodeOwners": true,
+	"gitAuthor": "Renovate Bot <bot@external-dns.com>",
+	"onboarding": false,
+	"platform": "github",
+	"repositories": [
+		"kubernetes-sigs/external-dns"
+	],
+	"printConfig": false,
+	"prConcurrentLimit": 0,
+	"prHourlyLimit": 0,
+	"stabilityDays": 3,
+	"pruneStaleBranches": true,
+	"recreateClosed": true,
+	"dependencyDashboard": false,
+	"requireConfig": false,
+	"rebaseWhen": "behind-base-branch",
+	"baseBranches": ["master", "main"],
+	"recreateWhen": "always",
+	"semanticCommits": "enabled",
+	"pre-commit": {
+		"enabled": true
+	},
+	"labels": ["{{depType}}", "datasource::{{datasource}}", "type::{{updateType}}", "manager::{{manager}}"], // can be overridden per packageRule
+	"addLabels": ["renovate-bot"], // cannot be overridden, any packageRule config extends this
+	"packageRules": [
+		{
+			"groupName": "pre-commit",
+			"matchManagers": ["pre-commit"],
+			"addLabels": ["pre-commit", "skip-release"]
+		},
+	],
+	"enabledManagers": [ // supported managers https://docs.renovatebot.com/modules/manager/
+		"regex",
+		"pre-commit"
+	],
+	"customManagers": [ // https://docs.renovatebot.com/modules/manager/regex/
+		{
+			// to capture registry.k8s.io/external-dns/external-dns:<version> in *.md files
+			"customType": "regex",
+			"fileMatch": [
+				".*\\.md$"
+			],
+			"matchStrings": [
+				"(?<depName>registry.k8s.io\/external-dns\/external-dns):(?<currentValue>.*)"
+			],
+			"depNameTemplate": "kubernetes-sigs/external-dns",
+			"datasourceTemplate": "github-releases",
+			"versioningTemplate": "semver"
+		}
+	]
+};
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 000000000..344c613b6
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,3 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}
diff --git a/.github/renovate.json5 b/.github/renovate.json5
deleted file mode 100644
index 98386621c..000000000
--- a/.github/renovate.json5
+++ /dev/null
@@ -1,32 +0,0 @@
-// Dependency Update Configuration
-//
-// See https://docs.renovatebot.com/configuration-options/
-// See https://json5.org/ for JSON5 syntax
-{
-	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
-	"addLabels": [
-		"renovate"
-	],
-	// https://docs.renovatebot.com/configuration-options/#rebasewhen
-	"rebaseWhen": "conflicted",
-	"enabledManagers": [ // supported managers https://docs.renovatebot.com/modules/manager/
-		"regex"
-	],
-	"packageRules": [ // https://docs.renovatebot.com/configuration-options/#packagerules
-	],
-	"customManagers": [ // https://docs.renovatebot.com/modules/manager/regex/
-		{
-			// to capture registry.k8s.io/external-dns/external-dns:<version> in *.md files
-			"customType": "regex",
-			"fileMatch": [
-				".*\\.md$"
-			],
-			"matchStrings": [
-				"(?<depName>registry.k8s.io\/external-dns\/external-dns):(?<currentValue>.*)"
-			],
-			"depNameTemplate": "kubernetes-sigs/external-dns",
-			"datasourceTemplate": "github-releases",
-			"versioningTemplate": "semver"
-		}
-	]
-}
diff --git a/.github/workflows/dependency-update.yaml b/.github/workflows/dependency-update.yaml
new file mode 100644
index 000000000..1b4d4c96d
--- /dev/null
+++ b/.github/workflows/dependency-update.yaml
@@ -0,0 +1,27 @@
+name: update-versions-with-renovate
+
+on:
+  push:
+    branches: [main, master]
+  schedule:
+    # https://crontab.guru/
+    - cron: '0 4 * * *'
+
+jobs:
+  update-versions-with-renovate:
+    runs-on: ubuntu-latest
+    if: github.repository == 'kubernetes-sigs/external-dns'
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4.2.2
+      # https://github.com/renovatebot/github-action
+      - name: self-hosted renovate
+        uses: renovatebot/github-action@v41.0.14
+        with:
+          # docker-cmd-file: .github/renovate-entrypoint.sh
+          # docker-user: root
+          # https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication
+          token: ${{ secrets.GITHUB_TOKEN }}
+          configurationFile: .github/renovate-config.js
+        env:
+          LOG_LEVEL: info