diff --git a/.buildkite/pull-requests.json b/.buildkite/pull-requests.json
index a1e506227e..d31e68506e 100644
--- a/.buildkite/pull-requests.json
+++ b/.buildkite/pull-requests.json
@@ -4,7 +4,7 @@
         "pipeline_slug": "fleet-server",
         "allow_org_users": true,
         "allowed_repo_permissions": ["admin", "write"],
-        "allowed_list": ["dependabot[bot]", "mergify[bot]", "github-actions[bot]"],
+        "allowed_list": ["dependabot[bot]", "elastic-renovate-prod[bot]", "mergify[bot]", "github-actions[bot]"],
         "set_commit_status": true,
         "build_on_commit": true,
         "build_on_comment": true,
@@ -18,7 +18,7 @@
         "pipeline_slug": "fleet-server-package-mbp",
         "allow_org_users": true,
         "allowed_repo_permissions": ["admin", "write"],
-        "allowed_list": ["dependabot[bot]", "mergify[bot]", "github-actions[bot]", "elastic-vault-github-plugin-prod[bot]"],
+        "allowed_list": ["dependabot[bot]", "elastic-renovate-prod[bot]", "mergify[bot]", "github-actions[bot]", "elastic-vault-github-plugin-prod[bot]"],
         "set_commit_status": false,
         "build_on_commit": false,
         "build_on_comment": true,
@@ -31,7 +31,7 @@
         "pipeline_slug": "fleet-server-perf-tests",
         "allow_org_users": true,
         "allowed_repo_permissions": ["admin", "write"],
-        "allowed_list": ["dependabot[bot]", "mergify[bot]", "github-actions[bot]", "elastic-vault-github-plugin-prod[bot]"],
+        "allowed_list": ["dependabot[bot]", "elastic-renovate-prod[bot]", "mergify[bot]", "github-actions[bot]", "elastic-vault-github-plugin-prod[bot]"],
         "set_commit_status": false,
         "build_on_commit": false,
         "build_on_comment": true,
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index b8fc5fd163..0000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,56 +0,0 @@
----
-version: 2
-updates:
-  - package-ecosystem: "gomod"
-    directories:
-      - "/"
-      - "/pkg/api/"
-      - "/testing/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "08:00"
-    labels:
-      - automation
-      - dependency
-      - Team:Elastic-Agent-Control-Plane
-      - backport-active-all
-    open-pull-requests-limit: 10
-    groups:
-      elastic:
-        patterns:
-          - "github.com/elastic/*"
-          - "go.elastic.co/*"
-      test-tooling:
-        patterns:
-          - "github.com/testcontainers/*"
-          - "github.com/Shopify/*"
-          - "github.com/moby/*"
-          - "github.com/magefile/mage"
-          - "github.com/stretchr/*"
-      go-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: github-actions
-    directories:
-      - '/'
-      - '/.github/actions/*'
-    schedule:
-      interval: "weekly"
-      day: "sunday"
-      time: "22:00"
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-
-  - package-ecosystem: pre-commit
-    directory: "/"
-    schedule:
-      interval: 'weekly'
-      day: 'sunday'
-      time: '22:00'
-    open-pull-requests-limit: 5
-    labels:
-      - 'changelog:dependencies'
diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependency-update.yml
similarity index 68%
rename from .github/workflows/post-dependabot.yml
rename to .github/workflows/post-dependency-update.yml
index 6fedf93ca2..dfebb9f7bd 100644
--- a/.github/workflows/post-dependabot.yml
+++ b/.github/workflows/post-dependency-update.yml
@@ -1,13 +1,14 @@
-# Follow-on actions relating to dependabot PRs. In elastic/fleet-server, any changes to
-# dependencies contained in go.mod requires the change to be reflected in the
-# NOTICE.txt file. When dependabot creates a branch for a go_modules change this
-# will update the NOTICE.txt file for that change.
-name: post-dependabot
+# Follow-on actions for dependency update PRs (Dependabot and Renovate). In
+# elastic/fleet-server, changes to dependencies in go.mod require NOTICE.txt and
+# NOTICE-fips.txt to be updated. This workflow applies those follow-on changes to
+# the dependency update branch.
+name: post-dependency-update
 
 on:
   push:
     branches:
       - 'dependabot/go_modules/**'
+      - 'renovate/*golang/**'
 
 permissions:
   contents: read
@@ -42,9 +43,9 @@ jobs:
       - name: commit modified files
         if: steps.check-files.outputs.modified == 'true'
         run: |
-          git config --global user.name 'dependabot[bot]'
-          git config --global user.email 'dependabot[bot]@users.noreply.github.com'
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
           git add NOTICE.txt NOTICE-fips.txt testing/go.mod testing/go.sum
           git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
-          git commit -m "Post dependabot file modifications"
+          git commit -m "Post dependency update file modifications"
           git push
diff --git a/.github/workflows/update-renovate-branches.yml b/.github/workflows/update-renovate-branches.yml
new file mode 100644
index 0000000000..1c40a727af
--- /dev/null
+++ b/.github/workflows/update-renovate-branches.yml
@@ -0,0 +1,59 @@
+---
+name: update-renovate-branches
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+env:
+  JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - id: generator
+        uses: elastic/oblt-actions/elastic/active-branches@v1
+        with:
+          filter-branches: true
+
+      - uses: actions/checkout@v7
+
+      - name: Update baseBranchPatterns in renovate.json
+        env:
+          MATRIX: ${{ steps.generator.outputs.matrix }}
+        run: |
+          branches=$(printf '%s' "$MATRIX" | jq -c '[.include[].branch]')
+          jq --argjson branches "$branches" '.baseBranchPatterns = $branches' \
+            renovate.json > renovate.json.new
+          mv renovate.json.new renovate.json
+
+      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "[Automation] Update Renovate base branches to current active branches"
+          title: "[Automation] Update Renovate base branches to current active branches"
+          body: |
+            Updates `baseBranchPatterns` in `renovate.json` to match the current set of active release branches queried from the Elastic release schedule.
+          branch: update-renovate-branches
+          base: main
+          delete-branch: true
+          labels: |
+            automation
+            skip-changelog
+            backport-skip
+            Team:Elastic-Agent-Control-Plane
+
+      - if: ${{ failure() }}
+        uses: elastic/oblt-actions/slack/send@v1
+        with:
+          bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
+          channel-id: "#fleet-notifications"
+          message: ":traffic_cone: Renovate branches update failed for `${{ github.repository }}`, @fleet_team please look what's going on <${{ env.JOB_URL }}|here>"
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000000..04d1e569c5
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,72 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "dependencyDashboard": true,
+  "enabledManagers": ["gomod", "github-actions", "pre-commit"],
+  "baseBranchPatterns": ["main", "9.5", "9.4", "9.3", "8.19"],
+  "labels": [
+    "automation",
+    "dependency",
+    "skip-changelog",
+    "backport-skip",
+    "Team:Elastic-Agent-Control-Plane"
+  ],
+  "pre-commit": {
+    "enabled": true
+  },
+  "packageRules": [
+    {
+      "description": "Go modules: schedule, PR limit, and branch prefix",
+      "matchManagers": ["gomod"],
+      "additionalBranchPrefix": "golang/",
+      "schedule": ["on monday"],
+      "prConcurrentLimit": 10
+    },
+    {
+      "description": "go-dependencies: catch-all group for Go modules not claimed by a more specific group",
+      "matchManagers": ["gomod"],
+      "groupName": "go-dependencies"
+    },
+    {
+      "description": "elastic: all Elastic org packages",
+      "matchManagers": ["gomod"],
+      "matchPackageNames": [
+        "/^github\\.com/elastic//",
+        "/^go\\.elastic\\.co//"
+      ],
+      "groupName": "elastic"
+    },
+    {
+      "description": "test-tooling: dependencies used for tests and test infrastructure",
+      "matchManagers": ["gomod"],
+      "matchPackageNames": [
+        "/^github\\.com/testcontainers//",
+        "/^github\\.com/Shopify//",
+        "/^github\\.com/moby//",
+        "/^github\\.com/magefile/mage$/",
+        "/^github\\.com/stretchr//"
+      ],
+      "groupName": "test-tooling"
+    },
+    {
+      "description": "GitHub Actions: grouped weekly Sunday updates",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions",
+      "schedule": ["on sunday"],
+      "prConcurrentLimit": 10
+    },
+    {
+      "description": "GitHub Actions: keep macOS runner updates manual",
+      "matchManagers": ["github-actions"],
+      "matchDepTypes": ["github-runner"],
+      "matchPackageNames": ["macos"],
+      "enabled": false
+    },
+    {
+      "description": "pre-commit: weekly Sunday updates",
+      "matchManagers": ["pre-commit"],
+      "schedule": ["on sunday"],
+      "addLabels": ["changelog:dependencies"],
+      "prConcurrentLimit": 5
+    }
+  ]
+}