diff --git a/playbooks/renovate/dry-run.yaml b/playbooks/renovate/dry-run.yaml
index c07f7db..ccbe164 100644
--- a/playbooks/renovate/dry-run.yaml
+++ b/playbooks/renovate/dry-run.yaml
@@ -6,6 +6,7 @@
         RENOVATE_GIT_AUTHOR: "Renovatebot <renovatebot@vexxhost.dev>"
         # Common
         GITHUB_COM_TOKEN: "{{ renovate.github_token }}"
+        RENOVATE_ALLOWED_COMMANDS: '["^curl"]'
         # Dry-run
         RENOVATE_DRY_RUN: true
         RENOVATE_PLATFORM: local
diff --git a/playbooks/renovate/run.yaml b/playbooks/renovate/run.yaml
index 593c375..fe1a153 100644
--- a/playbooks/renovate/run.yaml
+++ b/playbooks/renovate/run.yaml
@@ -8,6 +8,7 @@
         GITHUB_COM_TOKEN: "{{ renovate.github_token }}"
         RENOVATE_ENDPOINT: "https://{{ zuul.project.canonical_hostname == 'github.com' | ternary('api.github.com', 'review.vexxhost.dev') }}"
         RENOVATE_PLATFORM: "{{ zuul.project.canonical_hostname == 'github.com' | ternary('github', 'gerrit') }}"
+        RENOVATE_ALLOWED_COMMANDS: '["^curl"]'
         # GitHub
         RENOVATE_TOKEN: "{{ zuul.project.canonical_hostname == 'github.com' | ternary(renovate.github_token, omit) }}"
         # Gerrit