diff --git a/.devcontainer/post-create.sh b/.devcontainer/post-create.sh
index bb271de79..cc3412c05 100755
--- a/.devcontainer/post-create.sh
+++ b/.devcontainer/post-create.sh
@@ -23,7 +23,13 @@
 
 set -euo pipefail
 
+# These are pinned because the fisher bootstrap below is remote code being
+# sourced, and a pin nothing watches is how a version ends up four years
+# stale. The annotations let renovate track them; see customManagers in
+# .renovaterc.json5.
+# renovate: datasource=github-releases depName=jorgebucaran/fisher
 readonly FISHER_VERSION=4.4.8
+# renovate: datasource=github-releases depName=jorgebucaran/nvm.fish
 readonly NVM_FISH_VERSION=2.2.17
 
 # .nvmrc is what nvm.fish reads; engines.node is what pnpm enforces. Both files
diff --git a/.renovaterc.json5 b/.renovaterc.json5
index f39cbdfd4..018289d7a 100755
--- a/.renovaterc.json5
+++ b/.renovaterc.json5
@@ -25,6 +25,32 @@
   semanticCommits: "enabled",
   commitMessageAction: "bump",
   commitMessageTopic: "{{depName}}",
+  // Nothing else watches these two files. Everything installed through npm is
+  // covered by the managers above, but a version pinned in a URL or a shell
+  // variable is invisible to renovate without being told -- which is how the
+  // dprint dockerfile plugin reached four years out of date and stopped being
+  // able to parse a digest-pinned FROM line.
+  customManagers: [
+    {
+      customType: "regex",
+      description: "dprint plugins, pinned by URL in dprint.json",
+      managerFilePatterns: ["/^dprint\\.json$/"],
+      matchStrings: [
+        "https://plugins\\.dprint\\.dev/(?<depName>[a-z-]+)-(?<currentValue>\\d+\\.\\d+\\.\\d+)\\.wasm",
+      ],
+      depNameTemplate: "dprint/dprint-plugin-{{{depName}}}",
+      datasourceTemplate: "github-releases",
+    },
+    {
+      customType: "regex",
+      description: "fish tooling pinned in the dev container post-create script",
+      managerFilePatterns: ["/^\\.devcontainer/post-create\\.sh$/"],
+      matchStrings: [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\sreadonly \\w+=(?<currentValue>\\S+)",
+      ],
+    },
+  ],
+
   packageRules: [
     {
       matchUpdateTypes: ["minor", "patch", "pin", "digest"],
diff --git a/dprint.json b/dprint.json
index b84f3baee..271081aca 100644
--- a/dprint.json
+++ b/dprint.json
@@ -3,7 +3,7 @@
   "dockerfile": {},
   "excludes": [],
   "plugins": [
-    "https://plugins.dprint.dev/toml-0.6.1.wasm",
-    "https://plugins.dprint.dev/dockerfile-0.3.0.wasm"
+    "https://plugins.dprint.dev/toml-0.7.0.wasm",
+    "https://plugins.dprint.dev/dockerfile-0.4.1.wasm"
   ]
 }