diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 204a4ac..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-
-updates:
-
-    # supported ecosystems:
-    # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem-
-
-    # update for GitHub Actions
-    - package-ecosystem: github-actions
-      directory: "/"  # will search .github/workflows
-      labels:
-          - "dependencies"
-          - "github_actions"
-      open-pull-requests-limit: 9
-      schedule:
-          interval: "weekly"
-      cooldown:
-          default-days: 7
-
-    # update uv.lock file
-    - package-ecosystem: "uv"
-      directory: "/"
-      labels:
-          - "dependencies"
-          - "python"
-          - "uv"
-      open-pull-requests-limit: 9
-      schedule:
-          interval: "monthly"
-      cooldown:
-          default-days: 7
diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml
deleted file mode 100644
index 1954f71..0000000
--- a/.github/workflows/dependabot-auto-merge.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-
-# Security references:
-#  - https://securitylab.github.com/resources/github-actions-preventing-pwn-requests
-#  - https://securitylab.github.com/resources/github-actions-untrusted-input
-#  - https://securitylab.github.com/resources/github-actions-building-blocks
-#  - https://securitylab.github.com/resources/github-actions-new-patterns-and-mitigations
-
-
-name: Auto Merge Dependabot
-
-on:
-  pull_request:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  auto-merge:
-    name: Auto Merge Dependabot
-
-    runs-on: ubuntu-latest
-
-    timeout-minutes: 5
-
-    permissions:
-      contents: write # Required to squash/merge/rebase the dependabot PR
-      pull-requests: write # Required to approve and merge the pull request
-      workflows: write # Required when the dependabot PR itself modifies workflow files
-
-    # Only run for Dependabot PRs - security: prevent running on PRs from forks or other actors
-    # Uses the PR creator (pull_request.user.login) rather than github.actor, which reflects
-    # the last actor to touch the ref and can be spoofed via a crafted commit history.
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
-
-    steps:
-
-      # repo: https://github.com/actions/checkout
-      # releases: https://github.com/actions/checkout/tags
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-            persist-credentials: false
-
-      # repo: https://github.com/fastify/github-action-merge-dependabot
-      # releases: https://github.com/fastify/github-action-merge-dependabot/tags
-      # The action waits for required status checks by default
-      - uses: fastify/github-action-merge-dependabot@73ec4cbb5e56df5591eae286972d5b2201ffe90f  # v3.15.0
-        with:
-            # github-token: ${{ secrets.TOKEN_AUTOMERGE }}
-            # Using built-in GITHUB_TOKEN for better security (auto-scoped, auto-expires)
-            # Falls back to TOKEN_AUTOMERGE if GITHUB_TOKEN lacks permissions
-            github-token: ${{ secrets.GITHUB_TOKEN }}
-            merge-method: squash  # merge|squash|rebase
-            target: minor
diff --git a/renovate.json b/renovate.json
index 5db72dd..ada4957 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,5 +2,31 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
+  ],
+  "labels": ["dependencies"],
+  "minimumReleaseAge": "7 days",
+  "platformAutomerge": false,
+  "automergeStrategy": "squash",
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 5am on the first day of the month"],
+    "automerge": true
+  },
+  "packageRules": [
+    {
+      "description": "Auto-merge non-major updates once every CI check on the branch has passed. Renovate merges itself (platformAutomerge=false) because main has no required status checks, so GitHub native auto-merge would not wait for CI.",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest", "bump"],
+      "automerge": true
+    },
+    {
+      "description": "Major updates always need a manual review.",
+      "matchUpdateTypes": ["major"],
+      "automerge": false
+    },
+    {
+      "description": "cyclopts>=4 makes App.__call__ always sys.exit() (breaks CLI tests); cyclopts>=5 requires Python>=3.11. Keep in sync with pyproject.toml.",
+      "matchPackageNames": ["cyclopts"],
+      "allowedVersions": "<4"
+    }
   ]
 }