diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
new file mode 100644
index 0000000000..0a5231bcea
--- /dev/null
+++ b/.github/workflows/renovate.yml
@@ -0,0 +1,19 @@
+name: Renovate
+on:
+  workflow_dispatch:
+  schedule:
+    # The "*" (#42, asterisk) character has special semantics in YAML, so this
+    # string has to be quoted.
+    - cron: '0/5 * * * *'
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.2
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v40.3.5
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          RENOVATE_REPOSITORIES: "smokestacklightnin/nebari"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d1074a1862..d85a55ae8a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -82,3 +82,8 @@ repos:
       - id: terraform_fmt
         args:
           - --args=-write=true
+
+  - repo: https://github.com/renovatebot/pre-commit-hooks
+    rev: 39.17.1
+    hooks:
+      - id: renovate-config-validator
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000000..0157816b32
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "packageRules": [
+    {
+      "allowedVersions": "<6.0",
+      "matchPackageNames": [
+        "hashicorp/google"
+      ]
+    },
+    {
+      "allowedVersions": "<=1.5.0",
+      "matchPackageNames": [
+        "hashicorp/terraform"
+      ]
+    }
+  ]
+}
diff --git a/src/_nebari/stages/kubernetes_keycloak/template/modules/kubernetes/keycloak-helm/main.tf b/src/_nebari/stages/kubernetes_keycloak/template/modules/kubernetes/keycloak-helm/main.tf
index 7e02ea102d..93599c25f2 100644
--- a/src/_nebari/stages/kubernetes_keycloak/template/modules/kubernetes/keycloak-helm/main.tf
+++ b/src/_nebari/stages/kubernetes_keycloak/template/modules/kubernetes/keycloak-helm/main.tf
@@ -4,7 +4,7 @@ resource "helm_release" "keycloak" {
 
   repository = "https://codecentric.github.io/helm-charts"
   chart      = "keycloak"
-  version    = "15.0.2"
+  version    = "15.1.0"
 
   values = concat([
     # https://github.com/codecentric/helm-charts/blob/keycloak-15.0.2/charts/keycloak/values.yaml