diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 00000000..377cc593
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,24 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "pinDigests": true,
+  "prConcurrentLimit": 0,
+  "branchConcurrentLimit": 0,
+  "prHourlyLimit": 0,
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "trino-aws-proxy/src/test/java/io/trino/aws/proxy/server/testing/containers/S3Container.java"
+      ],
+      "matchStrings": [
+        "cgr\\.dev/chainguard/minio@(?<currentDigest>sha256:[a-f0-9]+)"
+      ],
+      "depNameTemplate": "cgr.dev/chainguard/minio",
+      "datasourceTemplate": "docker",
+      "currentValueTemplate": "latest"
+    }
+  ]
+}
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index ca7689c8..430476e7 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -20,10 +20,10 @@ jobs:
 
     steps:
     - name: Checkout project
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Set up JDK
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
       with:
         java-version: '22'
         distribution: 'temurin'