diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..b4ac99e
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,34 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Image tags in versions.env",
+      "managerFilePatterns": ["/^versions\\.env$/"],
+      "matchStrings": [
+        "(?:^|\\n)[A-Z0-9_]+_IMAGE=(?<depName>[^:\\s]+):(?<currentValue>[^\\s@]+)"
+      ],
+      "datasourceTemplate": "docker"
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "Database majors need a dump/restore, so never propose them",
+      "matchDepNames": ["postgres", "prodrigestivill/postgres-backup-local"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
+    {
+      "description": "Stay on the 10.6 LTS line; 10.11 is effectively a major upgrade",
+      "matchDepNames": ["mariadb"],
+      "allowedVersions": "/^10\\.6\\./"
+    },
+    {
+      "matchDepNames": ["amir20/dozzle"],
+      "prBodyNotes": [
+        "Also bump the Dozzle agents on the TrueNAS hosts to the same tag. The hub and agents share the TLS pair baked into the image."
+      ]
+    }
+  ]
+}