diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 92bb553..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-
-updates:
-
-    # supported ecosystems:
-    # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-
-
-    # update for GitHub Actions
-    - package-ecosystem: github-actions
-      directory: "/"  # will search .github/workflows
-      labels:
-          - "dependencies"
-          - "github_actions"
-      open-pull-requests-limit: 9
-      schedule:
-          interval: "weekly"
-
-    # update uv.lock file
-    - package-ecosystem: "uv"
-      directory: "/"
-      labels:
-          - "dependencies"
-          - "python"
-          - "uv"
-      open-pull-requests-limit: 9
-      schedule:
-          interval: "monthly"
diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml
deleted file mode 100644
index dc93b7a..0000000
--- a/.github/workflows/dependabot-auto-merge.yaml
+++ /dev/null
@@ -1,44 +0,0 @@
-
-# Security references:
-#  - https://securitylab.github.com/resources/github-actions-preventing-pwn-requests
-#  - https://securitylab.github.com/resources/github-actions-untrusted-input
-#  - https://securitylab.github.com/resources/github-actions-building-blocks
-#  - https://securitylab.github.com/resources/github-actions-new-patterns-and-mitigations
-
-
-name: Auto Merge Dependabot
-
-on:
-  pull_request:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  auto-merge:
-
-    runs-on: ubuntu-latest
-
-    timeout-minutes: 5
-
-    # Only run for Dependabot PRs - security: prevent running on PRs from forks or other actors
-    if: github.actor == 'dependabot[bot]'
-
-    steps:
-
-      # repo: https://github.com/actions/checkout
-      # releases: https://github.com/actions/checkout/tags
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1 released on 09-01-2026
-
-      # repo: https://github.com/fastify/github-action-merge-dependabot
-      # releases: https://github.com/fastify/github-action-merge-dependabot/tags
-      # The action waits for required status checks by default
-      - uses: fastify/github-action-merge-dependabot@73ec4cbb5e56df5591eae286972d5b2201ffe90f  # v3.15.0 released on 03-10-2025
-        with:
-            # github-token: ${{ secrets.TOKEN_AUTOMERGE }}
-            # Using built-in GITHUB_TOKEN for better security (auto-scoped, auto-expires)
-            # Falls back to TOKEN_AUTOMERGE if GITHUB_TOKEN lacks permissions
-            github-token: ${{ secrets.GITHUB_TOKEN }}
-            merge-method: squash  # merge|squash|rebase
-            target: minor
diff --git a/.just/gh.justfile b/.just/gh.justfile
index ff842d7..5dd3109 100644
--- a/.just/gh.justfile
+++ b/.just/gh.justfile
@@ -230,16 +230,16 @@ gh-browse-wiki:
     gh browse --wiki
 
 
-# list dependabot PRs
+# list renovate PRs
 [group: 'gh']
-gh-pr-list-dependabot limit="10":
-    gh pr list --author app/dependabot --limit {{limit}}
+gh-pr-list-renovate limit="10":
+    gh pr list --author app/renovate --limit {{limit}}
 
 
-# list all dependabot PRs (including closed)
+# list all renovate PRs (including closed)
 [group: 'gh']
-gh-pr-list-dependabot-all limit="20":
-    gh pr list --state all --author app/dependabot --limit {{limit}}
+gh-pr-list-renovate-all limit="20":
+    gh pr list --state all --author app/renovate --limit {{limit}}
 
 
 # view GitHub Actions usage (billing)
diff --git a/renovate.json b/renovate.json
index 5db72dd..10cb579 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,5 +2,54 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
+  ],
+  "labels": [
+    "dependencies"
+  ],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": [
+      "* 0-3 1 * *"
+    ]
+  },
+  "packageRules": [
+    {
+      "description": "Label GitHub Actions updates",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "addLabels": [
+        "github_actions"
+      ]
+    },
+    {
+      "description": "Label Python dependency updates",
+      "matchManagers": [
+        "pep621"
+      ],
+      "addLabels": [
+        "python",
+        "uv"
+      ]
+    },
+    {
+      "description": "Auto-merge minor and patch updates once all checks pass (replaces the Dependabot auto-merge workflow)",
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ],
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "squash",
+      "platformAutomerge": false
+    },
+    {
+      "description": "myst-parser >= 5 requires Python >= 3.11; keep the pin for Python < 3.10 as is",
+      "matchPackageNames": [
+        "myst-parser"
+      ],
+      "matchCurrentValue": "/< 4\\.0/",
+      "enabled": false
+    }
   ]
 }