diff --git a/Dockerfile b/Dockerfile
index 45b6459..9ca2ad2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.14-slim@sha256:2751cbe93751f0147bc1584be957c6dd4c5f977c3d4e0396b56456a9fd4ed137
 
 # Install deps
 COPY requirements.txt .
diff --git a/release_drafter.py b/release_drafter.py
index 929d80a..e344300 100644
--- a/release_drafter.py
+++ b/release_drafter.py
@@ -10,6 +10,12 @@ import semver
 from requests.adapters import HTTPAdapter
 from urllib3 import Retry
 
+print("DEBUG: env vars seen by Python")
+for k, v in os.environ.items():
+    if k.startswith("INPUT_"):
+        print(f"{k}={v}")
+
+
 @dataclass
 class LabelConfig:
     priority: int
@@ -45,7 +51,7 @@ class ReleaseManager:
         """Validate all required environment variables are present."""
         required_vars = {
             "FORGEJO_API_URL": os.getenv("INPUT_ENDPOINT"),
-            "REPO": os.getenv("INPUT_REPO")
+            "REPO": os.getenv("INPUT_REPO"),
             "FORGEJO_TOKEN": os.getenv("INPUT_TOKEN"),
         }
 
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..27ef67b
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,20 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": [
+        "local>entwirr.me/renovate-config"
+    ],
+    "commitMessagePrefix": "chore(deps):",
+    "enabledManagers": ["dockerfile", "github-actions", "pip_requirements"],
+    "rangeStrategy": "update-lockfile",
+    "updatePinnedDependencies": true,
+    "packageRules": [
+        {
+            "matchPackageNames": ["*"],
+            "matchUpdateTypes": ["major", "minor", "patch", "pin", "digest"]
+        },
+        {
+            "matchManagers": ["composer", "github-actions", "pip_requirements"],
+            "addLabels": ["chore"]
+        }
+    ]
+}
diff --git a/requirements.txt b/requirements.txt
index 2db6103..9181e4c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,3 @@
-requests
-semver
+requests~=2.32.5
+semver~=3.0.4
+urllib3~=2.6.0
\ No newline at end of file