diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..61a23eb
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,35 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices"
+  ],
+  "dependencyDashboard": true,
+  "timezone": "Europe/Paris",
+  "osvVulnerabilityAlerts": true,
+  "customManagers": [
+    {
+      // https://docs.renovatebot.com/modules/manager/regex/
+      "customType": "regex",
+      "managerFilePatterns": ["update.sh"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\sversions=\\([0-9\\. ]+?(?<currentValue>\\S+)\\)"
+      ]
+    }
+  ],
+  "packageRules": [
+    {
+      "matchPackageNames": ["php"],
+      "matchDatasources": ["docker"],
+      // Override helpers:pinGitHubActionDigests from config:best-practices since we explicitely
+      // want the latest PHP patch version and not a pinned Docker image
+      "pinDigests": false,
+      "prBodyNotes": [
+        "**Do NOT merge this PR as-is!**",
+        "",
+        "This PR is only a reminder that a new PHP version is available, however Renovate doesn't allow us to do everything we need to do.",
+        "You need to _add_ the new PHP version to the `versions` array in `update.sh` instead of replacing the last.",
+        "You also need to update the `README.md` to list supported versions."
+      ]
+    }
+  ]
+}
diff --git a/update.sh b/update.sh
index 9d4351c..de13108 100755
--- a/update.sh
+++ b/update.sh
@@ -2,6 +2,7 @@
 
 set -euo pipefail
 
+# renovate: datasource=docker depName=php
 versions=(7.3 7.4 8.0 8.1 8.2 8.3 8.4)
 
 for version in "${versions[@]}"; do