diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4fb6460..81acda6 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -65,8 +65,6 @@ jobs:
       contents: read
     strategy:
       fail-fast: false
-      # TODO: set up Renovate to keep these digests fresh and
-      # to help discover new Kubernetes minor versions to add here.
       matrix:
         include:
           - kube-minor: "1.37"
diff --git a/renovate.json b/renovate.json
index 3e4b91a..710ae55 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,5 +2,27 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "local>bootc-dev/infra:renovate-shared-config.json"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.github/workflows/ci\\.yaml$/"],
+      "matchStrings": [
+        "(?:BINK_COMMIT|bink-commit):\\s+(?<currentDigest>[a-f0-9]{40})"
+      ],
+      "depNameTemplate": "bootc-dev/bink",
+      "datasourceTemplate": "git-refs",
+      "packageNameTemplate": "https://github.com/bootc-dev/bink",
+      "currentValueTemplate": "main"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.github/workflows/ci\\.yaml$/"],
+      "matchStrings": [
+        "kube-minor: \"(?<currentValue>\\d+\\.\\d+)\"\\s+digest: (?<currentDigest>sha256:[a-f0-9]+)"
+      ],
+      "depNameTemplate": "ghcr.io/bootc-dev/bink/node",
+      "datasourceTemplate": "docker"
+    }
   ]
 }