diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000..d07ff33
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,58 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices"
+  ],
+  "packageRules": [
+    {
+      "matchFileNames": [
+        ".github/**/*.yml",
+        ".tool-versions"
+      ],
+      "groupName": "dev tools"
+    },
+    {
+      "matchFileNames": [
+        "rebar.config"
+      ],
+      "groupName": "rebar.config deps"
+    },
+    {
+      "matchFileNames": [
+        "package.json",
+        ".nvmrc"
+      ],
+      "groupName": "package.json + .nvmrc deps"
+    },
+    {
+      "matchPackagePrefixes": [
+        "minimum_otp_vsn"
+      ],
+      "enabled": false
+    }
+  ],
+  "customManagers": [
+    {
+      "description": "Match versions (per datasource and depName) in .github/**/*.yml",
+      "customType": "regex",
+      "fileMatch": [
+        ".github/.*/.*\\.yml"
+      ],
+      "matchStrings": [
+        "# renovate datasource: (?<datasource>[^,]+), depName: (?<depName>[^\\n]+)\\n.+?(?<currentValue>v?\\d+(\\.\\d+(\\.\\d+)?)?)\\n"
+      ]
+    },
+    {
+      "description": "Match versions in rebar.config",
+      "customType": "regex",
+      "fileMatch": [
+        "rebar.config"
+      ],
+      "datasourceTemplate": "hex",
+      "matchStrings": [
+        "{(?<depName>[^,]+), \"(?<currentValue>\\d+\\.\\d+(\\.\\d+)?)\""
+      ],
+      "versioningTemplate": "semver"
+    }
+  ]
+}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1887f6d..6c9facd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,24 +10,26 @@ jobs:
     strategy:
       matrix:
         os:
-          - ubuntu-latest
-          - macos-latest
+          # renovate datasource: github-runners, depName: ubuntu
+          - ubuntu-20.04
+          # renovate datasource: github-runners, depName: macos
+          - macos-12
 
     runs-on: ${{matrix.os}}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4.1.6
 
       - name: parse-tool-versions
-        uses: paulo-ferraz-oliveira/parse-tool-versions@v1
+        uses: paulo-ferraz-oliveira/parse-tool-versions@v1.0.3
         id: tool-versions
 
       - name: nodejs
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4.0.2
         with:
           node-version: ${{steps.tool-versions.outputs.nodejs}}
 
       - name: plugin-test
-        uses: asdf-vm/actions/plugin-test@v2
+        uses: asdf-vm/actions/plugin-test@v3.0.2
         with:
           command: markdownlint-cli2 _version
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 95b603b..2265fd7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -5,22 +5,22 @@ name: Lint
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4.1.6
 
       - name: install
-        uses: asdf-vm/actions/install@v2
+        uses: asdf-vm/actions/install@v3.0.2
 
       - name: lint.bash
         run: scripts/lint.bash
 
   actionlint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4.1.6
 
       - name: Check workflow files
         uses: docker://rhysd/actionlint:1.6.23
@@ -28,14 +28,14 @@ jobs:
           args: -color
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4.1.6
 
       # uses .markdownlint.yml for configuration
       - name: markdownlint
-        uses: DavidAnson/markdownlint-cli2-action@v11
+        uses: DavidAnson/markdownlint-cli2-action@v16.0.0
         with:
           globs: |
             .github/**/*.md
@@ -43,7 +43,7 @@ jobs:
             LICENSE
 
       - name: yamllint
-        uses: ibiqlik/action-yamllint@v3
+        uses: ibiqlik/action-yamllint@v3.1.1
         with:
           file_or_dir: |
             .github/workflows/*.yml
diff --git a/renovate.json b/renovate.json
deleted file mode 100644
index 5db72dd..0000000
--- a/renovate.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ]
-}