diff --git a/.woodpecker/renovate.yml b/.woodpecker/renovate.yml
new file mode 100644
index 0000000..08e4703
--- /dev/null
+++ b/.woodpecker/renovate.yml
@@ -0,0 +1,43 @@
+# ============================================================
+# Renovate Bot - Cron Pipeline
+# ============================================================
+# WOODPECKER v3 REQUIREMENTS - DO NOT DOWNGRADE SYNTAX:
+#
+#   CORRECT (v3):
+#     environment:
+#       MY_VAR:
+#         from_secret: my_secret
+#
+#   WRONG (v1/v2 - BREAKS in v3):
+#     secrets: [my_secret]
+#     secrets:
+#       - my_secret
+#
+# This pipeline ONLY runs on the "renovate" cron schedule.
+# It does NOT run on push events - that is handled by .woodpecker.yml
+# ============================================================
+
+when:
+  - event: cron
+    cron: renovate
+
+steps:
+  run-renovate:
+    image: renovate/renovate:latest
+    # Pull policy: always ensure latest renovate image
+    pull: true
+    environment:
+      # ⚠️ Woodpecker v3 syntax - from_secret map form required
+      RENOVATE_TOKEN:
+        from_secret: renovate_token
+      # Renovate platform config - self-hosted Gitea
+      RENOVATE_PLATFORM: gitea
+      RENOVATE_ENDPOINT: https://git.bryanmail.net
+      RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@bryanmail.net>"
+      # Repos to scan - space-separated for multiple
+      RENOVATE_REPOSITORIES: "homelab/compose-files"
+      # Use the renovate.json in the repo root for all other config
+      RENOVATE_CONFIG_FILE: renovate.json
+      LOG_LEVEL: info
+    commands:
+      - renovate