diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6e361d51..6207c95b 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -52,13 +52,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Restore from cache and install vcpkg
-        uses: lukka/run-vcpkg@v11
+        uses: lukka/run-vcpkg@v11.5
         with:
           vcpkgGitCommitId: 8d3649ba34aab36914ddd897958599aa0a91b08e
           vcpkgJsonGlob: '**/mingw/vcpkg.json'
 
       - name: Run CMake with vcpkg.json manifest
-        uses: lukka/run-cmake@v10
+        uses: lukka/run-cmake@v10.7
         with:
           configurePreset: mingw-${{ matrix.arch }}
           buildPreset: mingw-${{ matrix.arch }}
@@ -274,26 +274,26 @@ jobs:
       runs-on: windows-latest
       steps:
       - uses: actions/checkout@v4
-      - uses: lukka/get-cmake@latest
+      - uses: lukka/get-cmake@v3.30.1
 
       - name: Install rst2html
         run: python -m pip install --upgrade pip docutils
 
       - name: Restore artifacts, or setup vcpkg (do not install any package)
-        uses: lukka/run-vcpkg@v11
+        uses: lukka/run-vcpkg@v11.5
         with:
           vcpkgGitCommitId: 8d3649ba34aab36914ddd897958599aa0a91b08e
           vcpkgJsonGlob: '**/windows/vcpkg.json'
 
       - name: Run CMake with vcpkg.json manifest (NO TESTS)
-        uses: lukka/run-cmake@v10
+        uses: lukka/run-cmake@v10.7
         if: ${{ matrix.arch == 'arm64' }}
         with:
           configurePreset: win-${{ matrix.arch }}-release
           buildPreset: win-${{ matrix.arch }}-release
 
       - name: Run CMake with vcpkg.json manifest
-        uses: lukka/run-cmake@v10
+        uses: lukka/run-cmake@v10.7
         if: ${{ matrix.arch != 'arm64' }}
         with:
           configurePreset: win-${{ matrix.arch }}-release
@@ -344,6 +344,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: libressl
+          # versioning=semver-coerced
           repository: libressl/portable
           ref: v3.8.3
       - name: "libressl: autogen.sh"
@@ -403,6 +404,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: mbedtls
+          # versioning=semver-coerced
           repository: Mbed-TLS/mbedtls
           ref: v3.5.2
       - name: "mbedtls: make no_test"
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..1e699551
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,40 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "packageRules": [
+        {
+            "matchDepTypes": [
+                "action"
+            ],
+            "groupName": "github actions",
+            "pinDigests": true,
+            "extends": [
+                "schedule:monthly"
+            ]
+        },
+        {
+            "matchDepNames": [
+                "vcpkg"
+            ],
+            "extends": [
+                "schedule:monthly"
+            ]
+        }
+    ],
+    "customManagers": [
+        {
+            "customType": "regex",
+            "fileMatch": ["^\\.github/workflows/.+\\.ya?ml$"],
+            "matchStrings": ["vcpkgGitCommitId:\\s*(?<currentDigest>.*?)\\n"],
+            "currentValueTemplate": "master",
+            "depNameTemplate": "vcpkg",
+            "packageNameTemplate": "https://github.com/microsoft/vcpkg",
+            "datasourceTemplate": "git-refs"
+        },
+        {
+            "customType": "regex",
+            "fileMatch": ["^\\.github/workflows/.+\\.ya?ml$"],
+            "matchStrings": ["versioning=(?<versioning>.*?)\\n\\s*repository:\\s*(?<depName>.*?)\\n\\s*ref:\\s*(?<currentValue>.*?)\\n"],
+            "datasourceTemplate": "github-tags"
+        }
+    ]
+}