diff --git a/.github/actions/build-antora-site/action.yml b/.github/actions/build-antora-site/action.yml
index e1d85f4..1444f0f 100644
--- a/.github/actions/build-antora-site/action.yml
+++ b/.github/actions/build-antora-site/action.yml
@@ -10,10 +10,12 @@ inputs:
   antora-version:
     description: "@antora/cli and @antora/site-generator version."
     required: false
+    # renovate: datasource=npm depName=@antora/cli
     default: "3.1.14"
   kroki-version:
     description: "asciidoctor-kroki version."
     required: false
+    # renovate: datasource=npm depName=asciidoctor-kroki
     default: "0.18.1"
   playbook:
     description: "Path to the Antora playbook."
diff --git a/.github/actions/setup-git-cliff/action.yml b/.github/actions/setup-git-cliff/action.yml
index a1a75b5..a16ad69 100644
--- a/.github/actions/setup-git-cliff/action.yml
+++ b/.github/actions/setup-git-cliff/action.yml
@@ -5,6 +5,7 @@ inputs:
   version:
     description: "git-cliff version, without the leading v."
     required: false
+    # renovate: datasource=github-releases depName=orhun/git-cliff
     default: "2.13.1"
   sha256:
     description: "SHA-256 of the x86_64-unknown-linux-gnu tarball. Change with `version`."
@@ -28,7 +29,17 @@ runs:
         TARBALL="$(mktemp -d)/git-cliff.tar.gz"
         curl -fsSL -o "$TARBALL" \
           "https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
-        echo "${GIT_CLIFF_SHA256}  ${TARBALL}" | sha256sum -c -
+        # Spelled out rather than `sha256sum -c`, because Renovate can bump the
+        # version but cannot compute the new digest -- so this failure is the
+        # expected outcome of a version bump, and it should say what to paste.
+        ACTUAL="$(sha256sum "$TARBALL" | cut -d" " -f1)"
+        if [ "$ACTUAL" != "$GIT_CLIFF_SHA256" ]; then
+          echo "::error::git-cliff ${GIT_CLIFF_VERSION} checksum mismatch."
+          echo "::error::  expected: ${GIT_CLIFF_SHA256}"
+          echo "::error::  actual:   ${ACTUAL}"
+          echo "::error::If you are bumping the version, set the sha256 input default to the actual value above."
+          exit 1
+        fi
         # /usr/local/bin is on PATH and runner-writable, so no sudo and no
         # $GITHUB_PATH write (zizmor flags the latter).
         tar -xzf "$TARBALL" --strip-components=1 -C /usr/local/bin \
diff --git a/.github/renovate.json5 b/.github/renovate.json5
index e4366a8..e6ab760 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -44,6 +44,27 @@
 
   osvVulnerabilityAlerts: true,
 
+  // Tool versions pinned inside workflows and composite actions are invisible to
+  // every built-in manager -- there is no manifest for them -- so they sat frozen
+  // while everything with a package file kept moving. The `# renovate:` comment
+  // above each one is what makes it a tracked dependency.
+  //
+  // Not the customManagers:githubActionsVersions preset: that requires the value
+  // to sit on a `SOMETHING_VERSION:` key, and these are action-input `default:`s.
+  customManagers: [
+    {
+      customType: "regex",
+      managerFilePatterns: [
+        "/^\\.github/actions/.+/action\\.ya?ml$/",
+        "/^\\.github/workflows/.+\\.ya?ml$/",
+      ],
+      matchStrings: [
+        "# renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>\\S+)\\s+default: \"(?<currentValue>[^\"]+)\"",
+        "# renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>\\S+)\\s+VERSION=\"(?<currentValue>[^\"]+)\"",
+      ],
+    },
+  ],
+
   packageRules: [
 
     // =====================================================
@@ -60,6 +81,13 @@
       allowedVersions: "<=21",
     },
 
+    {
+      // asciidoctor-kroki 1.x is not compatible with Antora, which is the only
+      // thing that uses it here. Lift when Antora supports it.
+      matchDepNames: ["asciidoctor-kroki"],
+      allowedVersions: "<1",
+    },
+
     // =====================================================
     // Version classification labels
     // =====================================================
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b2ba565..3d61d7d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,6 +26,7 @@ jobs:
 
       - name: Install actionlint
         run: |
+          # renovate: datasource=github-releases depName=rhysd/actionlint
           VERSION="1.7.7"
           curl -fsSL \
             "https://github.com/rhysd/actionlint/releases/download/v${VERSION}/actionlint_${VERSION}_linux_amd64.tar.gz" \