diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 78fe1dd..8ee714f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
     name: Lint and format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -55,7 +55,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -94,7 +94,7 @@ jobs:
     name: cargo-deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           command: check
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d836bf8..e645780 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
     name: Build Linux binaries
     runs-on: ${{ vars.GH_RUNNER_DEFAULT || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -53,7 +53,7 @@ jobs:
           cp target/aarch64-unknown-linux-gnu/release/git-scrub dist/git-scrub-linux-arm64
 
       - name: Upload linux binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: linux-binaries
           path: |
@@ -68,7 +68,7 @@ jobs:
     name: Build macOS binaries
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -92,7 +92,7 @@ jobs:
           cp target/aarch64-apple-darwin/release/git-scrub dist/git-scrub-darwin-arm64
 
       - name: Upload macOS binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: macos-binaries
           path: |
@@ -118,13 +118,13 @@ jobs:
     env:
       HOMEBREW_APP_ID: ${{ secrets.HOMEBREW_APP_ID }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "lts/*"
 
@@ -139,7 +139,7 @@ jobs:
             conventional-changelog-conventionalcommits
 
       - name: Install Go (for nFPM)
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: ">=1.22"
           cache: false
@@ -151,13 +151,13 @@ jobs:
 
       # Download artefacts from the build jobs
       - name: Download linux binaries
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: linux-binaries
           path: dist/
 
       - name: Download macOS binaries
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: macos-binaries
           path: dist/
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..89b0ca9
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,7 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Inherits the org preset: 7-day supply-chain cooldown on external dependencies, same-org and CVE bypasses, PR-only, grouped updates, and SHA-pinning for GitHub Actions (helpers:pinGitHubActionDigests converts tag-pinned actions to commit SHAs).",
+  "extends": [
+    "github>hyperi-io/renovate-config"
+  ]
+}