diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
new file mode 100644
index 0000000..dfe45eb
--- /dev/null
+++ b/.github/workflows/renovate.yaml
@@ -0,0 +1,31 @@
+name: Renovate
+on:
+  schedule:
+    # The "*" (#42, asterisk) character has special semantics in YAML, so this
+    # string has to be quoted.
+    - cron: "0 0 * * 1"
+  workflow_dispatch:
+jobs:
+  renovate:
+    name: Renovate
+    environment: CI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: create_token
+        with:
+          client-id: ${{ vars.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
+        env:
+          RENOVATE_REPOSITORIES: '[{ repository: "inversify/graphql", bumpVersion: true }]'
+        with:
+          configurationFile: config/renovate/renovate-global.json
+          token: ${{ steps.create_token.outputs.token }}
diff --git a/config/renovate/renovate-global.json b/config/renovate/renovate-global.json
new file mode 100644
index 0000000..b69f866
--- /dev/null
+++ b/config/renovate/renovate-global.json
@@ -0,0 +1,5 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-global-schema.json",
+  "allowedCommands": [],
+  "binarySource": "install"
+}