diff --git a/.github/renovate-central.json5 b/.github/renovate-central.json5
new file mode 100644
index 0000000..e310997
--- /dev/null
+++ b/.github/renovate-central.json5
@@ -0,0 +1,35 @@
+// Central renovate configuration for runs orchestrated by
+// .github/workflows/renovate-schedule.yml. This file is the global config for
+// every target repository listed in .github/renovate-repositories.json;
+// repository-local configs (renovate.json[5], .github/renovate.json[5], ...)
+// still apply per repository on top.
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  // Commit author: intentionally NOT set via gitAuthor. The workflows run
+  // with platformCommit enabled and GitHub App tokens, so GitHub itself sets
+  // the commit author and renovate auto-discovers its own identity from
+  // whichever App's token the run uses — regardless of whether the run comes
+  // from the central sweeper or a repository-local workflow.
+  //
+  // gitIgnoredAuthors: commits with these author emails count as renovate's
+  // own when checking whether a branch was edited externally (otherwise the
+  // branch is skipped as "pr-edited"). List every GitHub App that may run
+  // renovate against the swept repositories, so branches written by one App's
+  // runs are accepted by another App's runs (e.g. central sweeper vs.
+  // repo-local runs with different credentials). A repository-level
+  // gitIgnoredAuthors REPLACES this list (non-mergeable) — repeat entries you
+  // still need. Keep the list tight: noreply author emails are spoofable.
+  // Derive an email: curl -s https://api.github.com/users/odgbot%5Bbot%5D | grep '"id"' -> <id>+<slug>[bot]@users.noreply.github.com
+  gitIgnoredAuthors: [
+    // (bare email only: renovate compares gitIgnoredAuthors against %ae/%ce
+    // author/committer emails, never against 'Name <email>')
+    // odgbot - production central sweeper for ODG (https://github.com/apps/odgbot)
+    '319464553+odgbot[bot]@users.noreply.github.com',
+    // ocmbot - will be used later again when we expand beyond ODG
+    '125909804+ocmbot[bot]@users.noreply.github.com',
+  ],
+  // Add org-wide defaults here, e.g.:
+  // labels: ['dependencies'],
+  // timezone: 'Europe/Berlin',
+  // schedule: ['at any time'],
+}
diff --git a/.github/renovate-repositories.json b/.github/renovate-repositories.json
index 17f56dd..3d8bafb 100644
--- a/.github/renovate-repositories.json
+++ b/.github/renovate-repositories.json
@@ -1,3 +1,3 @@
 [
-  "open-component-model/odg-ui"
+  "open-component-model/.github"
 ]
diff --git a/.github/renovate.json5 b/.github/renovate.json5
index e310997..2996467 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,35 +1,50 @@
-// Central renovate configuration for runs orchestrated by
-// .github/workflows/renovate-schedule.yml. This file is the global config for
-// every target repository listed in .github/renovate-repositories.json;
-// repository-local configs (renovate.json[5], .github/renovate.json[5], ...)
-// still apply per repository on top.
 {
   $schema: 'https://docs.renovatebot.com/renovate-schema.json',
-  // Commit author: intentionally NOT set via gitAuthor. The workflows run
-  // with platformCommit enabled and GitHub App tokens, so GitHub itself sets
-  // the commit author and renovate auto-discovers its own identity from
-  // whichever App's token the run uses — regardless of whether the run comes
-  // from the central sweeper or a repository-local workflow.
-  //
-  // gitIgnoredAuthors: commits with these author emails count as renovate's
-  // own when checking whether a branch was edited externally (otherwise the
-  // branch is skipped as "pr-edited"). List every GitHub App that may run
-  // renovate against the swept repositories, so branches written by one App's
-  // runs are accepted by another App's runs (e.g. central sweeper vs.
-  // repo-local runs with different credentials). A repository-level
-  // gitIgnoredAuthors REPLACES this list (non-mergeable) — repeat entries you
-  // still need. Keep the list tight: noreply author emails are spoofable.
-  // Derive an email: curl -s https://api.github.com/users/odgbot%5Bbot%5D | grep '"id"' -> <id>+<slug>[bot]@users.noreply.github.com
-  gitIgnoredAuthors: [
-    // (bare email only: renovate compares gitIgnoredAuthors against %ae/%ce
-    // author/committer emails, never against 'Name <email>')
-    // odgbot - production central sweeper for ODG (https://github.com/apps/odgbot)
-    '319464553+odgbot[bot]@users.noreply.github.com',
-    // ocmbot - will be used later again when we expand beyond ODG
-    '125909804+ocmbot[bot]@users.noreply.github.com',
+  extends: [
+    'config:recommended',
+    'config:best-practices',
+    'helpers:pinGitHubActionDigests',
+    'docker:pinDigests',
+    'security:openssf-scorecard',
+    ':dependencyDashboard',
+    ':rebaseStalePrs',
+  ],
+  'internalChecksFilter': 'strict',
+  'minimumReleaseAge': '7 days',
+  'branchPrefix': 'renovate/',
+  prConcurrentLimit: 5,
+  prHourlyLimit: 0,
+  automerge: false,
+  automergeType: 'pr',
+  vulnerabilityAlerts: {
+    minimumReleaseAge: null,
+    automerge: false,
+  },
+  packageRules: [
+    {
+      // Majors wait as checkboxes in the dependency dashboard ("Pending
+      // Approval") instead of occupying prConcurrentLimit slots - tick one
+      // there to have its PR created when you're ready to work on it.
+      matchUpdateTypes: ['major'],
+      dependencyDashboardApproval: true,
+    },
+    {
+      matchUpdateTypes: ['patch'],
+      automerge: true,
+    },
+    {
+      matchManagers: ['github-actions'],
+      automerge: true,
+    },
+  ],
+  customManagers: [
+    {
+      // Track the Renovate version used in the reusable workflow
+      customType: 'regex',
+      managerFilePatterns: ['.github/workflows/renovate.yml'],
+      matchStrings: ["renovate-version:\\s*'(?<currentValue>[^'@]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?'"],
+      depNameTemplate: 'ghcr.io/renovatebot/renovate',
+      datasourceTemplate: 'docker',
+    },
   ],
-  // Add org-wide defaults here, e.g.:
-  // labels: ['dependencies'],
-  // timezone: 'Europe/Berlin',
-  // schedule: ['at any time'],
 }
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 4c84d44..32cf64d 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -21,6 +21,7 @@ on:
     paths:
       - '.github/workflows/renovate.yml'
       - '.github/workflows/renovate-schedule.yml'
+      - '.github/renovate-central.json5'
       - '.github/renovate.json5'
       - '.github/renovate-repositories.json'
       - '.release-please-manifest.json'
diff --git a/.github/workflows/renovate-schedule.yml b/.github/workflows/renovate-schedule.yml
index 72b4d2c..d35dfb6 100644
--- a/.github/workflows/renovate-schedule.yml
+++ b/.github/workflows/renovate-schedule.yml
@@ -48,6 +48,7 @@ on:
     branches:
       - main
     paths:
+      - .github/renovate-central.json5
       - .github/renovate.json5
       - .github/renovate-repositories.json
       - .github/workflows/renovate.yml
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 86dd5ef..f6b4d11 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -88,8 +88,8 @@ env:
   # Path of the central config inside the central repository (checked out
   # sparse into ./central below; RENOVATE_CONFIG_FILE points there for both
   # validation and the renovate run itself).
-  central_config_file: .github/renovate.json5
-  RENOVATE_CONFIG_FILE: ${{ github.workspace }}/central/.github/renovate.json5
+  central_config_file: .github/renovate-central.json5
+  RENOVATE_CONFIG_FILE: ${{ github.workspace }}/central/.github/renovate-central.json5
   # Central config location ("owner/repo@ref"), split into CENTRAL_REPO /
   # CENTRAL_REF per job by the "Resolve central config location" step below —
   # expression contexts cannot split strings. The default tracks the floating