diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bd072b65..c789e317 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,16 +50,11 @@ jobs:
     - name: Install dependencies
       run: rye sync
 
-      # - name: Lints
-      #   run: 'pants lint ::'
-
-      # - name: Typecheck
-      #   run: 'pants typecheck ::'
-
     - name: Tests
       run: rye test
 
     - name: Changelog
+      if: ${{ !contains(github.event.head_commit.author, 'renovate') }}
       run: rye run build changelog check
 
       # - name: Upload coverage to CodeCov
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
new file mode 100644
index 00000000..6fa79afb
--- /dev/null
+++ b/.github/workflows/renovate.yml
@@ -0,0 +1,27 @@
+---
+name: Renovate
+on:
+  workflow_dispatch:
+  schedule:
+  - cron: '0 0 * * *'
+permissions:
+  pull-requests: write
+  contents: write
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4.1.6
+
+    - name: Apt install
+      run: sudo apt-get update && sudo apt-get install -y libxmlsec1-dev
+
+    - uses: eifinger/setup-rye@v4
+      id: setup-rye
+
+    - name: Self-hosted Renovate
+      uses: renovatebot/github-action@v40.2.4
+      with:
+        configurationFile: renovate-config.json
+        token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/renovate-config.json b/renovate-config.json
new file mode 100644
index 00000000..ba3cf046
--- /dev/null
+++ b/renovate-config.json
@@ -0,0 +1,5 @@
+{
+  "allowedPostUpgradeCommands": [
+    "rye .*"
+  ]
+}
diff --git a/renovate.json b/renovate.json
index 908cfbba..4bc8bed0 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,5 +2,10 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "local>mitodl/.github:renovate-config"
-  ]
+  ],
+  "postUpgradeTasks": {
+    "commands": ["rye sync"],
+    "fileFilters": ["requirements*.lock"],
+    "executionMode": "update"
+  }
 }