diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
new file mode 100644
index 000000000..0a5231bce
--- /dev/null
+++ b/.github/workflows/renovate.yml
@@ -0,0 +1,19 @@
+name: Renovate
+on:
+  workflow_dispatch:
+  schedule:
+    # The "*" (#42, asterisk) character has special semantics in YAML, so this
+    # string has to be quoted.
+    - cron: '0/5 * * * *'
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v40.3.5
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          RENOVATE_REPOSITORIES: "smokestacklightnin/nebari"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d1074a186..d85a55ae8 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -82,3 +82,8 @@ repos:
       - id: terraform_fmt
         args:
           - --args=-write=true
+
+  - repo: https://github.com/renovatebot/pre-commit-hooks
+    rev: 39.17.1
+    hooks:
+      - id: renovate-config-validator
diff --git a/pyproject.toml b/pyproject.toml
index a9a9b6d66..dabf522cd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -75,7 +75,7 @@ dependencies = [
     "pydantic==2.9.2",
     "pynacl==1.5.0",
     "python-keycloak>=3.9.0,<4.0.0",
-    "questionary==2.0.0",
+    "questionary==2.0.1",
     "requests-toolbelt==1.0.0",
     "rich==13.5.1",
     "ruamel.yaml==0.18.6",
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 000000000..0157816b3
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "packageRules": [
+    {
+      "allowedVersions": "<6.0",
+      "matchPackageNames": [
+        "hashicorp/google"
+      ]
+    },
+    {
+      "allowedVersions": "<=1.5.0",
+      "matchPackageNames": [
+        "hashicorp/terraform"
+      ]
+    }
+  ]
+}