diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 288e5e14..54e0ab62 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -55,6 +55,23 @@ jobs:
           echo "Changed files:"
           echo "${FILES}"
 
+  renovate-annotations:
+    name: Templated chart versions are visible to Renovate
+    # GitHub-hosted, nicht kind-testing-labda: der Job braucht weder Cluster
+    # noch machineshop, und auf den self-hosted Runnern scheitert
+    # actions/checkout beim Aufraeumen des Workspace an
+    # .claude/skills — das Verzeichnis ist im Repo getrackt und liegt dort
+    # aus einem frueheren Container-Job root:root, waehrend checkout als
+    # gh-runner laeuft (EACCES beim rmdir). Gleiche Konvention wie der
+    # validate-Gate in stuttgart-things/flux.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - name: Check "# renovate:" annotations
+        run: ./hack/check-chart-annotations.sh
+
   yaml-lint:
     name: Lint yaml files
     uses: stuttgart-things/github-workflow-templates/.github/workflows/call-yaml-lint.yaml@main
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3fd81ac0..c2652ffc 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -42,3 +42,12 @@ repos:
         language: python
         # for backward compatibility
         files: .*  # all files
+
+  - repo: local
+    hooks:
+      - id: check-chart-annotations
+        name: Templated chart versions carry a renovate annotation
+        entry: hack/check-chart-annotations.sh
+        language: script
+        pass_filenames: false
+        files: ^(apps|cicd|database|infra|monitoring)/.*\.ya?ml(\.gotmpl)?$
diff --git a/CLAUDE.md b/CLAUDE.md
index 55114168..bf4bc516 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -69,9 +69,75 @@ helmfile -f apps/grafana.yaml template \
 - **Commit messages**: Follow [Angular commit convention](https://www.conventionalcommits.org/) — semantic-release uses `@semantic-release/commit-analyzer` with Angular preset (`.releaserc`)
 - **Branch naming**: `feature/**`, `feat/**`, `fix/**`, `renovate/**`
 - **Releases**: Automated via `npx semantic-release` on `main` branch with tag format `v${version}`
-- **Dependency updates**: Renovate bot manages Helm chart version updates across all `.yaml` and `.yaml.gotmpl` files (`renovate.json`)
+- **Dependency updates**: Renovate manages Helm chart version updates (`renovate.json`) — see [Dependency Management](#dependency-management) for the annotation every templated chart version needs
 - **Domain sanitization**: A pre-commit hook replaces `.sva.de` domains with `.example.com` in committed files
 
+## Dependency Management
+
+Renovate is configured in `renovate.json` with the `helmfile` manager matching every
+`.yaml` / `.yaml.gotmpl` file, plus two `customManagers` for the templated versions
+described below. `.k2n/**` and `tests/**` are in `ignorePaths` — the k2n examples are
+generation input, not deployed state.
+
+### Templated chart versions need a `# renovate:` annotation
+
+Renovate's `helmfile` manager reads `releases[].version`. It cannot resolve Go
+templates — `version: {{ .Values.version }}` is skipped with
+`skipReason: contains-variable` and produces **no PR, no warning, no log entry**.
+
+Since the helmfiles keep their versions in `environments.default.values`, that hid
+every chart in this repo from Renovate. Each such value therefore carries a comment
+naming the datasource, and a `customManager` updates the default in place:
+
+```yaml
+environments:
+  default:
+    values:
+      # renovate: datasource=helm depName=cert-manager registryUrl=https://charts.jetstack.io
+      - version: v1.21.0
+```
+
+Derive the annotation from the `repositories` entry the release's `chart:` points at:
+
+| repositories entry | Annotation |
+|---|---|
+| `oci: true`, `url: ghcr.io/<path>` | `datasource=docker depName=ghcr.io/<path>/<chart>` |
+| plain HTTPS repo | `datasource=helm depName=<chart> registryUrl=<url>` |
+
+A `chart:` that is itself a full `oci://` URL (e.g. the gha-runner helmfiles) uses that
+URL verbatim as `depName`.
+
+**When adding a release, add the annotation too** — without it the chart is silently
+invisible to Renovate and will never be updated. `task check-renovate` (also wired into
+pre-commit and the CI workflow) fails on any templated chart version that is missing one.
+
+```bash
+task check-renovate      # fail on a missing annotation
+task lint-renovate       # validate renovate.json against the Renovate schema
+task preview-renovate    # dry-run Renovate against the working tree, writing nothing
+```
+
+### Never set `extractVersion` / `extractVersionTemplate`
+
+`extractVersion` does not only normalise the version for comparison — Renovate writes
+the **extracted** value back. With `^v?(?<version>.*)$` a registry tag of `v0.2.2` is
+written as `0.2.2`, and `ghcr.io/stuttgart-things/homerun`, `cert-manager` and
+`vcluster` are all tagged **with** the `v`, so the default would resolve to no chart at
+all. Leave the field off and each datasource's own versioning writes the tag back
+exactly as published.
+
+### Known lookup failure
+
+`docker-registry` (`database/registry.yaml.gotmpl`, `twuni` → https://helm.twun.io) is
+reported on the Dependency Dashboard as `Failed to look up helm package
+docker-registry: no-result`. Its version is hard-coded, so this is unrelated to the
+annotations — fixing it means repointing the helmfile at a repository that resolves.
+
+Worth re-checking with `task preview-renovate` after any change: `harbor` points at
+https://charts.bitnami.com/bitnami, which Bitnami has been winding down in favour of
+`oci://registry-1.docker.io/bitnamicharts`. If the lookup comes back empty, the
+helmfile's `repositories` entry needs repointing, not the annotation.
+
 ## Key Tools
 
 - **helmfile** — Declarative Helm chart deployment
diff --git a/Taskfile.yaml b/Taskfile.yaml
index 9300c68d..24f69d3e 100644
--- a/Taskfile.yaml
+++ b/Taskfile.yaml
@@ -545,3 +545,18 @@ tasks:
           --src "$SRC" \
           --helmfile-ref "$HELMFILE_NAME" \
           --progress plain -vv
+
+  check-renovate:
+    desc: Fail if a templated chart version lacks its "# renovate:" annotation
+    cmds:
+      - ./hack/check-chart-annotations.sh
+
+  lint-renovate:
+    desc: Validate renovate.json against the current Renovate schema
+    cmds:
+      - npx --yes --package renovate renovate-config-validator
+
+  preview-renovate:
+    desc: Dry-run Renovate locally and list the updates it would propose
+    cmds:
+      - LOG_LEVEL={{ .LOG_LEVEL | default "info" }} npx --yes --package renovate renovate --platform=local --dry-run=full
diff --git a/apps/awx.yaml.gotmpl b/apps/awx.yaml.gotmpl
index 9dfbb7d2..13c43ba8 100644
--- a/apps/awx.yaml.gotmpl
+++ b/apps/awx.yaml.gotmpl
@@ -2,6 +2,7 @@
 environments:
   default:
     values:
+      # renovate: datasource=helm depName=awx-operator registryUrl=https://ansible-community.github.io/awx-operator-helm/
       - version: 3.2.0
       - namespace: awx
       - installOperator: true
diff --git a/apps/backstage.yaml.gotmpl b/apps/backstage.yaml.gotmpl
index 875d775e..25482132 100644
--- a/apps/backstage.yaml.gotmpl
+++ b/apps/backstage.yaml.gotmpl
@@ -2,6 +2,7 @@
 environments:
   default:
     values:
+      # renovate: datasource=docker depName=ghcr.io/backstage/charts/backstage
       - version: "2.6.3"
       - namespace: backstage
       - clusterDomain: "172.18.0.3.nip.io"
diff --git a/apps/gitea.yaml.gotmpl b/apps/gitea.yaml.gotmpl
index 6ea15b3e..a089e3af 100644
--- a/apps/gitea.yaml.gotmpl
+++ b/apps/gitea.yaml.gotmpl
@@ -2,6 +2,7 @@
 environments:
   default:
     values:
+      # renovate: datasource=helm depName=gitea registryUrl=https://dl.gitea.com/charts
       - version: 12.1.3
       - namespace: gitea
       - enableIngress: false
diff --git a/apps/harbor.yaml.gotmpl b/apps/harbor.yaml.gotmpl
index 1608b690..f08e01f9 100644
--- a/apps/harbor.yaml.gotmpl
+++ b/apps/harbor.yaml.gotmpl
@@ -2,6 +2,7 @@
 environments:
   default:
     values:
+      # renovate: datasource=helm depName=harbor registryUrl=https://charts.bitnami.com/bitnami
       - version: 27.0.3
       - namespace: harbor
       - enablePersistence: true
@@ -19,6 +20,7 @@ environments:
       - createCertificateResource: false
       - deployHttpRoute: false
       - deployProjectProxy: false
+      # renovate: datasource=docker depName=ghcr.io/hiddenmarten/harbor-project-proxy
       - projectProxyVersion: 0.0.1
       - gatewayName: cilium-gateway
       - gatewayNamespace: default
diff --git a/apps/homerun-base-stack.yaml.gotmpl b/apps/homerun-base-stack.yaml.gotmpl
index db6d6a57..605c512c 100644
--- a/apps/homerun-base-stack.yaml.gotmpl
+++ b/apps/homerun-base-stack.yaml.gotmpl
@@ -2,6 +2,7 @@
 environments:
   default:
     values:
+      # renovate: datasource=docker depName=ghcr.io/stuttgart-things/homerun
       - version: {{ .Values.version | default "v0.2.1" }}
       - namespace: {{ .Values.namespace | default "homerun" }}
       - redisStackEnabled: {{ .Values.redisStackEnabled | default true }}
diff --git a/apps/kyverno.yaml.gotmpl b/apps/kyverno.yaml.gotmpl
index dc5b6a19..ebe4c699 100644
--- a/apps/kyverno.yaml.gotmpl
+++ b/apps/kyverno.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: kyverno
+      # renovate: datasource=helm depName=kyverno registryUrl=https://kyverno.github.io/kyverno/
       - version: 3.5.1
 ---
 releases:
diff --git a/apps/minio.yaml.gotmpl b/apps/minio.yaml.gotmpl
index 829ee519..28abf810 100644
--- a/apps/minio.yaml.gotmpl
+++ b/apps/minio.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: minio
+      # renovate: datasource=docker depName=ghcr.io/stuttgart-things/charts/minio/minio
       - version: 16.0.10
       - clusterIssuer: selfsigned
       - issuerKind: cluster-issuer
diff --git a/apps/rancher.yaml.gotmpl b/apps/rancher.yaml.gotmpl
index a20ac047..1e3fe9d0 100644
--- a/apps/rancher.yaml.gotmpl
+++ b/apps/rancher.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: cattle-system
+      # renovate: datasource=helm depName=rancher registryUrl=https://releases.rancher.com/server-charts/latest
       - version: 2.13.0
       - hostname: rancher-things
       - domain: example.com
diff --git a/apps/vault.yaml.gotmpl b/apps/vault.yaml.gotmpl
index f178d193..525874c3 100644
--- a/apps/vault.yaml.gotmpl
+++ b/apps/vault.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: vault
+      # renovate: datasource=docker depName=ghcr.io/stuttgart-things/charts/vault/vault
       - version: 1.9.0
       - deployCertificate: false
       - deployAutounseal: false
@@ -25,6 +26,7 @@ environments:
       - osShellRepository: stuttgart-things/os-shell
       - osShellTag: 12-debian-12-r50
       - osShellPullPolicy: IfNotPresent
+      # renovate: datasource=helm depName=vault-autounseal registryUrl=https://pytoshka.github.io/vault-autounseal
       - autounsealVersion: 0.5.3
       - autounsealVaultUrl: http://vault-server.vault.svc:8200
       - autounsealLabelSelector: app.kubernetes.io/component=server
diff --git a/cicd/argocd.yaml.gotmpl b/cicd/argocd.yaml.gotmpl
index 666b54a7..15113e86 100644
--- a/cicd/argocd.yaml.gotmpl
+++ b/cicd/argocd.yaml.gotmpl
@@ -7,6 +7,7 @@ environments:
       - serviceType: ClusterIP
       - adminPassword: ""
       - adminPasswordMTime: ""
+      # renovate: datasource=docker depName=ghcr.io/argoproj/argo-helm/argo-cd
       - version: 9.4.15
       - namespace: argocd
       - hostname: argocd
diff --git a/cicd/crossplane.yaml.gotmpl b/cicd/crossplane.yaml.gotmpl
index 503c06a4..69ee524b 100644
--- a/cicd/crossplane.yaml.gotmpl
+++ b/cicd/crossplane.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: crossplane-system
+      # renovate: datasource=helm depName=crossplane registryUrl=https://charts.crossplane.io/stable
       - version: 2.3.3
       # Providers are installed as Provider CRs (with RBAC) by
       # crossplane-providers.yaml.gotmpl, not via the upstream chart's
diff --git a/cicd/flux-operator.yaml.gotmpl b/cicd/flux-operator.yaml.gotmpl
index 0ad5d3e7..7c0d1fcc 100644
--- a/cicd/flux-operator.yaml.gotmpl
+++ b/cicd/flux-operator.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: flux-system
+      # renovate: datasource=docker depName=ghcr.io/controlplaneio-fluxcd/charts/flux-operator
       - version: 0.28.0
       - installOperator: true
 ---
diff --git a/cicd/gha-runner-controller.yaml.gotmpl b/cicd/gha-runner-controller.yaml.gotmpl
index 19db83dd..8fd5e771 100644
--- a/cicd/gha-runner-controller.yaml.gotmpl
+++ b/cicd/gha-runner-controller.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: arc-systems
+      # renovate: datasource=docker depName=ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller
       - version: 0.12.1
 ---
 releases:
diff --git a/cicd/gha-runner-scale-set.yaml.gotmpl b/cicd/gha-runner-scale-set.yaml.gotmpl
index 33ecb2b9..071c81e0 100644
--- a/cicd/gha-runner-scale-set.yaml.gotmpl
+++ b/cicd/gha-runner-scale-set.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: arc-runner
+      # renovate: datasource=docker depName=ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set
       - version: 0.12.1
       - repoName: ansible
       - ghaControllerNamespace: arc-systems
diff --git a/cicd/komoplane.yaml.gotmpl b/cicd/komoplane.yaml.gotmpl
index 54f49944..e8373627 100644
--- a/cicd/komoplane.yaml.gotmpl
+++ b/cicd/komoplane.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: crossplane-system
+      # renovate: datasource=helm depName=komoplane registryUrl=https://helm-charts.komodor.io
       - version: 0.1.6
       - enableIngress: true
       - clusterIssuer: selfsigned
diff --git a/cicd/tekton.yaml.gotmpl b/cicd/tekton.yaml.gotmpl
index ee4842ca..6799b496 100644
--- a/cicd/tekton.yaml.gotmpl
+++ b/cicd/tekton.yaml.gotmpl
@@ -9,6 +9,7 @@ environments:
       - imagePullPolicy: Always
       - disableInlineSpec: ""
       - enableTektonPipeline: true
+      # renovate: datasource=docker depName=ghcr.io/stuttgart-things/tekton/tekton
       - version: 0.77.5
       - enableTektonPruner: false
 ---
diff --git a/cicd/vcluster.yaml.gotmpl b/cicd/vcluster.yaml.gotmpl
index d22e3b44..3a5f23b1 100644
--- a/cicd/vcluster.yaml.gotmpl
+++ b/cicd/vcluster.yaml.gotmpl
@@ -4,6 +4,7 @@ environments:
     values:
       - namespace: vcluster
       - clusterName: vcluster
+      # renovate: datasource=helm depName=vcluster registryUrl=https://charts.loft.sh
       - version: v0.28.0
 ---
 releases:
diff --git a/database/keycloak.yaml.gotmpl b/database/keycloak.yaml.gotmpl
index 644f9a58..6819021c 100644
--- a/database/keycloak.yaml.gotmpl
+++ b/database/keycloak.yaml.gotmpl
@@ -18,6 +18,7 @@ environments:
       - storageClass: standard
       - issuerKindAnnotation: "cluster-issuer"
       - createCertificateResource: false
+      # renovate: datasource=docker depName=ghcr.io/stuttgart-things/charts/keycloak/keycloak
       - version: 25.2.0
       - imageRegistry: ghcr.io
       - imageRepository: stuttgart-things/keycloak
diff --git a/database/postgres.yaml.gotmpl b/database/postgres.yaml.gotmpl
index 1a56e5a8..f7749ed8 100644
--- a/database/postgres.yaml.gotmpl
+++ b/database/postgres.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: postgres
+      # renovate: datasource=helm depName=cloudnative-pg registryUrl=https://cloudnative-pg.github.io/charts
       - version: 0.24.0
 ---
 repositories:
diff --git a/database/postgresdb.yaml.gotmpl b/database/postgresdb.yaml.gotmpl
index e5bfee96..ed044cb7 100644
--- a/database/postgresdb.yaml.gotmpl
+++ b/database/postgresdb.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: postgres
+      # renovate: datasource=docker depName=ghcr.io/stuttgart-things/charts/postgresql/postgresql
       - version: 16.7.26
       - postgresPassword: "platformEngineer" # pragma: allowlist secret
       - username: "dev"
diff --git a/database/redis-stack.yaml.gotmpl b/database/redis-stack.yaml.gotmpl
index cc8b672e..d89cc649 100644
--- a/database/redis-stack.yaml.gotmpl
+++ b/database/redis-stack.yaml.gotmpl
@@ -2,6 +2,7 @@
 environments:
   default:
     values:
+      # renovate: datasource=docker depName=ghcr.io/stuttgart-things/charts/redis/redis
       - chartVersion: 17.1.4
       - namespace: redis-stack
       - serviceType: ClusterIP
diff --git a/database/zot.yaml.gotmpl b/database/zot.yaml.gotmpl
index 6fc1876c..8d4a6dbe 100644
--- a/database/zot.yaml.gotmpl
+++ b/database/zot.yaml.gotmpl
@@ -2,6 +2,7 @@
 environments:
   default:
     values:
+      # renovate: datasource=helm depName=zot registryUrl=https://zotregistry.dev/helm-charts/
       - version: 0.1.75
       - ingressEnabled: true
       - ingressClass: nginx
diff --git a/hack/check-chart-annotations.sh b/hack/check-chart-annotations.sh
new file mode 100755
index 00000000..2cff5cd3
--- /dev/null
+++ b/hack/check-chart-annotations.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+#
+# Fail if a helmfile release takes its chart version from an environment value
+# without a "# renovate:" annotation on that value.
+#
+# Renovate's helmfile manager reads releases[].version. A Go template such as
+#   version: {{ .Values.version }}
+# is skipped with skipReason "contains-variable" -- no PR, no warning, no log
+# entry. The annotation plus the customManager in renovate.json is what makes
+# the default in environments.default.values visible again.
+#
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+fail=0
+
+mapfile -t files < <(
+  git ls-files 'apps/*' 'cicd/*' 'database/*' 'infra/*' 'monitoring/*' \
+    | grep -E '\.ya?ml(\.gotmpl)?$' \
+    | grep -v '/values/'
+)
+
+for f in "${files[@]}"; do
+  grep -q '^releases:' "$f" || continue
+
+  # value keys referenced as a chart version, e.g. "version: {{ .Values.foo }}"
+  mapfile -t keys < <(
+    grep -oE '^[[:space:]]+version:[[:space:]]*\{\{[[:space:]]*\.Values\.[A-Za-z0-9_]+' "$f" \
+      | sed 's/.*\.Values\.//' | sort -u
+  )
+
+  for key in "${keys[@]:-}"; do
+    [ -n "$key" ] || continue
+
+    line=$(grep -nE "^[[:space:]]*-[[:space:]]+${key}:" "$f" | head -1 | cut -d: -f1 || true)
+    if [ -z "$line" ]; then
+      echo "ERROR: $f: chart version uses .Values.${key}, but no '- ${key}:' default exists in this file"
+      fail=1
+      continue
+    fi
+
+    if [ "$line" -lt 2 ] || ! sed -n "$((line - 1))p" "$f" | grep -q '# renovate:'; then
+      echo "ERROR: $f:${line}: '- ${key}:' has no '# renovate:' annotation -- Renovate will never update this chart"
+      fail=1
+    fi
+  done
+done
+
+if [ "$fail" -ne 0 ]; then
+  cat <<'HINT'
+
+Add the annotation directly above the value, derived from the repositories entry
+the release's chart points at:
+
+  OCI repo (oci: true)  ->  # renovate: datasource=docker depName=<host>/<path>/<chart>
+  plain HTTPS repo      ->  # renovate: datasource=helm depName=<chart> registryUrl=<url>
+
+Example:
+
+  environments:
+    default:
+      values:
+        # renovate: datasource=helm depName=cert-manager registryUrl=https://charts.jetstack.io
+        - version: v1.21.0
+
+Never add extractVersion / extractVersionTemplate: Renovate writes the extracted
+value back, so stripping a leading "v" produces a default that resolves to no tag.
+HINT
+  exit 1
+fi
+
+echo "OK: every templated chart version carries a '# renovate:' annotation"
diff --git a/infra/cert-manager.yaml.gotmpl b/infra/cert-manager.yaml.gotmpl
index 22c512ed..7dc1c203 100644
--- a/infra/cert-manager.yaml.gotmpl
+++ b/infra/cert-manager.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: cert-manager
+      # renovate: datasource=helm depName=cert-manager registryUrl=https://charts.jetstack.io
       - version: v1.21.0
       - config: selfsigned
       - installCrds: true
diff --git a/infra/cilium.yaml.gotmpl b/infra/cilium.yaml.gotmpl
index 45c3b78d..0e692e3e 100644
--- a/infra/cilium.yaml.gotmpl
+++ b/infra/cilium.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: kube-system
+      # renovate: datasource=helm depName=cilium registryUrl=https://helm.cilium.io
       - version: 1.19.5
       - configureLB: false
       - deployGateway: false
diff --git a/infra/ingress-nginx.yaml.gotmpl b/infra/ingress-nginx.yaml.gotmpl
index 81ecff36..2c525292 100644
--- a/infra/ingress-nginx.yaml.gotmpl
+++ b/infra/ingress-nginx.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: ingress-nginx
+      # renovate: datasource=helm depName=ingress-nginx registryUrl=https://kubernetes.github.io/ingress-nginx
       - version: 4.14.1
       - enableKindHostPort: false
       - enableNodePort: false
diff --git a/infra/longhorn.yaml.gotmpl b/infra/longhorn.yaml.gotmpl
index fb4c6e48..77ae8ff4 100644
--- a/infra/longhorn.yaml.gotmpl
+++ b/infra/longhorn.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: longhorn-system
+      # renovate: datasource=helm depName=longhorn registryUrl=https://charts.longhorn.io
       - version: 1.9.1
       - longhornDefaultClass: true
       - longhornDefaultFsType: ext4
diff --git a/infra/metallb.yaml.gotmpl b/infra/metallb.yaml.gotmpl
index b2f1f535..1d0f49d7 100644
--- a/infra/metallb.yaml.gotmpl
+++ b/infra/metallb.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: metallb-system
+      # renovate: datasource=docker depName=ghcr.io/stuttgart-things/charts/metallb/metallb
       - version: 6.4.22
       - ipRange: 0.0.0.0-0.0.0.10 # DUMMY RANGE
       - imageRegistry: ghcr.io
diff --git a/infra/metrics-server.yaml.gotmpl b/infra/metrics-server.yaml.gotmpl
index 7f352518..db4f442e 100644
--- a/infra/metrics-server.yaml.gotmpl
+++ b/infra/metrics-server.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: kube-system
+      # renovate: datasource=helm depName=metrics-server registryUrl=https://kubernetes-sigs.github.io/metrics-server
       - version: 3.13.0
 ---
 releases:
diff --git a/infra/nfs-csi.yaml.gotmpl b/infra/nfs-csi.yaml.gotmpl
index b2f6229b..720875fa 100644
--- a/infra/nfs-csi.yaml.gotmpl
+++ b/infra/nfs-csi.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: kube-system
+      # renovate: datasource=helm depName=csi-driver-nfs registryUrl=https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
       - version: v4.13.1
       - nfsProvisioner: true
       - storageClass: nfs-client
diff --git a/infra/nfs-server-provisioner.yaml.gotmpl b/infra/nfs-server-provisioner.yaml.gotmpl
index 4e8ef150..5058d9fa 100644
--- a/infra/nfs-server-provisioner.yaml.gotmpl
+++ b/infra/nfs-server-provisioner.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: kube-system
+      # renovate: datasource=helm depName=nfs-server-provisioner registryUrl=https://kvaps.github.io/charts
       - version: 1.8.0
 ---
 releases:
diff --git a/infra/openebs.yaml.gotmpl b/infra/openebs.yaml.gotmpl
index c0094256..02d6cfb5 100644
--- a/infra/openebs.yaml.gotmpl
+++ b/infra/openebs.yaml.gotmpl
@@ -24,6 +24,7 @@ environments:
       # unaffected by either toggle.
       - openebs_loki_enabled: true
       - openebs_alloy_enabled: true
+      # renovate: datasource=helm depName=openebs registryUrl=https://openebs.github.io/openebs
       - version: 4.5.1
 ---
 releases:
diff --git a/infra/trust-manager.yaml.gotmpl b/infra/trust-manager.yaml.gotmpl
index 1a102273..29f87e2b 100644
--- a/infra/trust-manager.yaml.gotmpl
+++ b/infra/trust-manager.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: cert-manager
+      # renovate: datasource=helm depName=trust-manager registryUrl=https://charts.jetstack.io
       - version: 0.22.0
       - trustNamespace: cert-manager
       - deployBundle: false
diff --git a/infra/velero.yaml.gotmpl b/infra/velero.yaml.gotmpl
index a379aca9..59482f59 100644
--- a/infra/velero.yaml.gotmpl
+++ b/infra/velero.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: velero
+      # renovate: datasource=helm depName=velero registryUrl=https://vmware-tanzu.github.io/helm-charts/
       - version: 10.1.0
       - backupsEnabled: true
       - snapshotsEnabled: true
diff --git a/monitoring/grafana.yaml.gotmpl b/monitoring/grafana.yaml.gotmpl
index 4c914767..b3e128cb 100644
--- a/monitoring/grafana.yaml.gotmpl
+++ b/monitoring/grafana.yaml.gotmpl
@@ -11,6 +11,7 @@ environments:
       - issuerKind: ClusterIssuer
       - enablePersistence: true
       - namespace: observability
+      # renovate: datasource=helm depName=grafana registryUrl=https://grafana.github.io/helm-charts/
       - version: 9.3.2
       - issuerKindAnnotation: "cluster-issuer"
       - createCertificateResource: false
diff --git a/monitoring/headlamp.yaml.gotmpl b/monitoring/headlamp.yaml.gotmpl
index c26379b2..bcd3d7d1 100644
--- a/monitoring/headlamp.yaml.gotmpl
+++ b/monitoring/headlamp.yaml.gotmpl
@@ -11,6 +11,7 @@ environments:
       - clusterIssuer: cluster-issuer-approle
       - issuerKind: ClusterIssuer
       - storageSize: 1Gi
+      # renovate: datasource=helm depName=headlamp registryUrl=https://kubernetes-sigs.github.io/headlamp/
       - version: 0.33.0
       - issuerKindAnnotation: "cluster-issuer"
       - createCertificateResource: false
diff --git a/monitoring/loki.yaml.gotmpl b/monitoring/loki.yaml.gotmpl
index 66c76ca9..5222b749 100644
--- a/monitoring/loki.yaml.gotmpl
+++ b/monitoring/loki.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: observability
+      # renovate: datasource=helm depName=loki registryUrl=https://grafana.github.io/helm-charts
       - version: 6.31.0
       - profile: fs
 ---
diff --git a/monitoring/promtail.yaml.gotmpl b/monitoring/promtail.yaml.gotmpl
index c181e92a..316efd6c 100644
--- a/monitoring/promtail.yaml.gotmpl
+++ b/monitoring/promtail.yaml.gotmpl
@@ -3,6 +3,7 @@ environments:
   default:
     values:
       - namespace: observability
+      # renovate: datasource=helm depName=promtail registryUrl=https://grafana.github.io/helm-charts
       - version: 6.17.0
       - lokiServiceName: openldap-loki
       - lokiNamespace: observability
diff --git a/renovate.json b/renovate.json
index c937b6ce..de7c965b 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,18 +3,41 @@
   "extends": [
     "config:recommended"
   ],
-  "registryAliases": {
-    "stable": "https://charts.helm.sh/stable"
-  },
   "commitMessageTopic": "helm chart {{depName}}",
+  "ignorePaths": [
+    ".k2n/**",
+    "tests/**"
+  ],
   "helmfile": {
-    "fileMatch": [
-      "(^|/).*\\.ya?ml(?:\\.gotmpl)?$"
+    "managerFilePatterns": [
+      "/(^|/).*\\.ya?ml(?:\\.gotmpl)?$/"
     ]
   },
   "helm-values": {
-    "fileMatch": [
-      "(^|/)values\\.ya?ml$"
+    "managerFilePatterns": [
+      "/(^|/)values\\.ya?ml$/"
     ]
-  }
+  },
+  "customManagers": [
+    {
+      "description": "Chart versions parameterized through helmfile environment values (invisible to the helmfile manager)",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^(apps|cicd|database|infra|monitoring)/.*\\.ya?ml(?:\\.gotmpl)?$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+?)(?:\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\n\\s*- \\w+: \"?(?<currentValue>[^\"{\\s][^\"\\s]*)\"?"
+      ]
+    },
+    {
+      "description": "Same, but where the environment value itself carries a Go template default",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^(apps|cicd|database|infra|monitoring)/.*\\.ya?ml(?:\\.gotmpl)?$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+?)(?:\\s+registryUrl=(?<registryUrl>\\S+))?\\s*\\n\\s*- \\w+: \\{\\{[^\\n]*default \"(?<currentValue>[^\"]+)\"[^\\n]*\\}\\}"
+      ]
+    }
+  ]
 }