diff --git a/.github/renovate-config.js b/.github/renovate-config.js
new file mode 100644
index 000000000..d21caf1c5
--- /dev/null
+++ b/.github/renovate-config.js
@@ -0,0 +1,57 @@
+"use strict";
+// https://github.com/renovatebot/github-action/blob/main/.github/renovate.json
+// https://docs.renovatebot.com/configuration-options/
+
+module.exports = {
+  "extends": [":disableRateLimiting", ":semanticCommits"],
+  "assigneesFromCodeOwners": true,
+  "gitAuthor": "Renovate Bot <bot@external-dns.com>",
+  "onboarding": false,
+  "platform": "github",
+  "repositories": [
+    "kubernetes-sigs/external-dns"
+  ],
+  "printConfig": false,
+  "prConcurrentLimit": 0,
+  "prHourlyLimit": 0,
+  "stabilityDays": 3,
+  "pruneStaleBranches": true,
+  "recreateClosed": true,
+  "dependencyDashboard": false,
+  "requireConfig": false,
+  "rebaseWhen": "behind-base-branch",
+  "baseBranches": ["master", "main"],
+  "recreateWhen": "always",
+  "semanticCommits": "enabled",
+  "pre-commit": {
+    "enabled": true
+  },
+  "labels": ["{{depType}}", "datasource::{{datasource}}", "type::{{updateType}}", "manager::{{manager}}"], // can be overridden per packageRule
+  "addLabels": ["renovate-bot"], // cannot be overridden, any packageRule config extends this
+  "packageRules": [
+    {
+      "groupName": "pre-commit",
+      "matchManagers": ["pre-commit"],
+      "addLabels": ["pre-commit", "skip-release"]
+    },
+  ],
+  "enabledManagers": [ // supported managers https://docs.renovatebot.com/modules/manager/
+    "regex",
+    "pre-commit"
+  ],
+  "customManagers": [ // https://docs.renovatebot.com/modules/manager/regex/
+    {
+      // to capture registry.k8s.io/external-dns/external-dns:<version> in *.md files
+      "customType": "regex",
+      "fileMatch": [
+        ".*\\.md$"
+      ],
+      "matchStrings": [
+        "(?<depName>registry.k8s.io\/external-dns\/external-dns):(?<currentValue>.*)"
+      ],
+      "depNameTemplate": "kubernetes-sigs/external-dns",
+      "datasourceTemplate": "github-releases",
+      "versioningTemplate": "semver"
+    }
+  ]
+};
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 000000000..7190a60b6
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}
diff --git a/.github/workflows/dependency-update.yaml b/.github/workflows/dependency-update.yaml
new file mode 100644
index 000000000..5f0c86f97
--- /dev/null
+++ b/.github/workflows/dependency-update.yaml
@@ -0,0 +1,26 @@
+name: update-versions-with-renovate
+
+on:
+  push:
+    branches: [main, master]
+  schedule:
+    # https://crontab.guru/
+    # once a day
+    - cron: '0 0 * * *'
+
+jobs:
+  update-versions-with-renovate:
+    runs-on: ubuntu-latest
+    if: github.repository == 'kubernetes-sigs/external-dns'
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4.2.2
+      # https://github.com/renovatebot/github-action
+      - name: self-hosted renovate
+        uses: renovatebot/github-action@v41.0.14
+        with:
+          # https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication
+          token: ${{ secrets.GITHUB_TOKEN }}
+          configurationFile: .github/renovate-config.js
+        env:
+          LOG_LEVEL: info