diff --git a/renovate/renovate.env.example b/renovate/renovate.env.example
new file mode 100644
index 0000000..d49d2bf
--- /dev/null
+++ b/renovate/renovate.env.example
@@ -0,0 +1,7 @@
+# renovate/renovate.env
+# Copy to renovate.env on the host (not committed - contains token)
+# The actual token is provisioned as a Woodpecker secret: renovate_token
+# This file is only needed if running the stack manually.
+
+GITEA_HOST=git.bryanmail.net
+RENOVATE_TOKEN=<gitea-renovate-bot-token>