diff --git a/.github/workflows/build-ddev.yml b/.github/workflows/build-ddev.yml
index bc2786b1b1423..439ec45b079c3 100644
--- a/.github/workflows/build-ddev.yml
+++ b/.github/workflows/build-ddev.yml
@@ -29,6 +29,7 @@ defaults:
 env:
   APP_NAME: ddev
   PYTHON_VERSION: "3.13"
+  # renovate: datasource=pypi depName=pyoxidizer
   PYOXIDIZER_VERSION: "0.24.0"
 
 jobs:
diff --git a/.github/workflows/release-dispatch.yml b/.github/workflows/release-dispatch.yml
index b6e1c71054fb7..9e2775500b8d8 100644
--- a/.github/workflows/release-dispatch.yml
+++ b/.github/workflows/release-dispatch.yml
@@ -40,6 +40,11 @@ permissions:
   id-token: write
   contents: write # ddev needs to push tags
 
+env:
+  # Default ddev version when callers don't pass `ddev-version`. Tracked by Renovate.
+  # renovate: datasource=pypi depName=ddev
+  DEFAULT_DDEV_VERSION: "14.3.2"
+
 jobs:
   prepare:
     name: Tag releases and build dispatch batches
@@ -55,7 +60,7 @@ jobs:
           fetch-depth: 0 # ddev needs full tag history
 
       - name: Install ddev
-        run: pip install "ddev${{ inputs.ddev-version && format('=={0}', inputs.ddev-version) || '==14.3.2' }}"
+        run: pip install "ddev==${{ inputs.ddev-version || env.DEFAULT_DDEV_VERSION }}"
 
       - name: Configure ddev
         env:
diff --git a/.github/workflows/validate-renovate-config.yml b/.github/workflows/validate-renovate-config.yml
new file mode 100644
index 0000000000000..2547c19d09d57
--- /dev/null
+++ b/.github/workflows/validate-renovate-config.yml
@@ -0,0 +1,20 @@
+name: Validate Renovate config
+
+on:
+  pull_request:
+    paths:
+      - 'renovate.json'
+  push:
+    branches:
+      - master
+    paths:
+      - 'renovate.json'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Validate Renovate config
+        run: npx --yes --package renovate renovate-config-validator --strict renovate.json
diff --git a/renovate.json b/renovate.json
index bce7e6fdd6995..10dd7ebcde91f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,21 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "enabledManagers": [
-    "github-actions"
+    "github-actions",
+    "custom.regex"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "^\\.github/workflows/[^/]+\\.ya?ml$"
+      ],
+      "matchStrings": [
+        "(?<depName>[a-zA-Z][a-zA-Z0-9._-]*)==(?<currentValue>[0-9]+(?:\\.[0-9]+){1,2})",
+        "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[a-zA-Z][a-zA-Z0-9._-]*)\\s+[A-Z][A-Z0-9_]*: \"(?<currentValue>[0-9]+(?:\\.[0-9]+){1,2})\""
+      ],
+      "datasourceTemplate": "pypi"
+    }
   ],
   "packageRules": [
     {
@@ -49,6 +63,20 @@
         "renovate/actions",
         "qa/skip-qa"
       ]
+    },
+    {
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "groupName": "workflow python deps",
+      "schedule": [
+        "before 6am on Monday"
+      ],
+      "labels": [
+        "renovate/workflow-deps",
+        "qa/skip-qa"
+      ],
+      "minimumReleaseAge": "7 days"
     }
   ]
 }