diff --git a/playbooks/renovate/dry-run.yaml b/playbooks/renovate/dry-run.yaml
new file mode 100644
index 0000000..c07f7db
--- /dev/null
+++ b/playbooks/renovate/dry-run.yaml
@@ -0,0 +1,11 @@
+- name: Run Renovate
+  tasks:
+    - name: renovate
+      environment:
+        LOG_LEVEL: debug
+        RENOVATE_GIT_AUTHOR: "Renovatebot <renovatebot@vexxhost.dev>"
+        # Common
+        GITHUB_COM_TOKEN: "{{ renovate.github_token }}"
+        # Dry-run
+        RENOVATE_DRY_RUN: true
+        RENOVATE_PLATFORM: local
diff --git a/playbooks/renovate/pre.yaml b/playbooks/renovate/pre.yaml
new file mode 100644
index 0000000..c8ea165
--- /dev/null
+++ b/playbooks/renovate/pre.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - ensure-renovate
diff --git a/playbooks/renovate/run.yaml b/playbooks/renovate/run.yaml
new file mode 100644
index 0000000..593c375
--- /dev/null
+++ b/playbooks/renovate/run.yaml
@@ -0,0 +1,15 @@
+- name: Run Renovate
+  tasks:
+    - name: renovate {{ zuul.project.name }}
+      environment:
+        LOG_LEVEL: debug
+        RENOVATE_GIT_AUTHOR: "Renovatebot <renovatebot@vexxhost.dev>"
+        # Common
+        GITHUB_COM_TOKEN: "{{ renovate.github_token }}"
+        RENOVATE_ENDPOINT: "https://{{ zuul.project.canonical_hostname == 'github.com' | ternary('api.github.com', 'review.vexxhost.dev') }}"
+        RENOVATE_PLATFORM: "{{ zuul.project.canonical_hostname == 'github.com' | ternary('github', 'gerrit') }}"
+        # GitHub
+        RENOVATE_TOKEN: "{{ zuul.project.canonical_hostname == 'github.com' | ternary(renovate.github_token, omit) }}"
+        # Gerrit
+        RENOVATE_USERNAME: "{{ zuul.project.canonical_hostname != 'github.com' | ternary(renovate.gerrit_username, omit) }}"
+        RENOVATE_PASSWORD: "{{ zuul.project.canonical_hostname != 'github.com' | ternary(renovate.gerrit_password, omit) }}"
diff --git a/roles/ensure-renovate/tasks/main.yaml b/roles/ensure-renovate/tasks/main.yaml
new file mode 100644
index 0000000..9af96f1
--- /dev/null
+++ b/roles/ensure-renovate/tasks/main.yaml
@@ -0,0 +1,11 @@
+- name: Install NodeJS
+  ansible.builtin.include_role:
+    name: ensure-nodejs
+  vars:
+    node_version: 22
+
+- name: Install Renovate
+  become: true
+  npm:
+    name: renovate
+    global: yes
diff --git a/zuul.d/renovate-jobs.yaml b/zuul.d/renovate-jobs.yaml
new file mode 100644
index 0000000..5a39169
--- /dev/null
+++ b/zuul.d/renovate-jobs.yaml
@@ -0,0 +1,19 @@
+- job:
+    name: renovate-base
+    abstract: true
+    intermediate: true
+    pre-run: playbooks/renovate/pre.yaml
+
+- job:
+    name: renovate-base-dry-run
+    parent: renovate
+    abstract: true
+    intermediate: true
+    run: playbooks/renovate/dry-run.yaml
+
+- job:
+    name: renovate-base-run
+    parent: renovate
+    abstract: true
+    intermediate: true
+    run: playbooks/renovate/run.yaml