diff --git a/k8s/forgejo/kustomization.yaml b/k8s/forgejo/kustomization.yaml
index 67a708c..f93527b 100644
--- a/k8s/forgejo/kustomization.yaml
+++ b/k8s/forgejo/kustomization.yaml
@@ -2,14 +2,17 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: forgejo
 resources:
- - namespace.yaml
- - config.yaml
- - ingress.yaml
- - services.yaml
- - statefulset.yaml
- - secrets.yaml
- - renovatebot.yaml
+  - namespace.yaml
+  - config.yaml
+  - ingress.yaml
+  - services.yaml
+  - statefulset.yaml
+  - secrets.yaml
+  - renovatebot.yaml
 configMapGenerator:
-- name: forgejo-templates-base
-  files:
-    - forgejo-templates-base/head_navbar.tmpl
+  - name: forgejo-templates-base
+    files:
+      - forgejo-templates-base/head_navbar.tmpl
+  - name: renovate-config
+    files:
+      - renovate/config.js
diff --git a/k8s/forgejo/renovate/config.js b/k8s/forgejo/renovate/config.js
new file mode 100644
index 0000000..bbb0fcd
--- /dev/null
+++ b/k8s/forgejo/renovate/config.js
@@ -0,0 +1,10 @@
+module.exports = {
+    autodiscover: true,
+    endpoint: 'https://git.janky.solutions',
+    gitAuthor: 'Renovate Bot <renovatebot@janky.solutions>',
+    platform: 'gitea',
+    allowScripts: true,
+    allowedPostUpgradeCommands: [
+        ".*"
+    ]
+};
diff --git a/k8s/forgejo/renovatebot.yaml b/k8s/forgejo/renovatebot.yaml
index 05c5a29..8d094c8 100644
--- a/k8s/forgejo/renovatebot.yaml
+++ b/k8s/forgejo/renovatebot.yaml
@@ -11,21 +11,18 @@ spec:
         spec:
           containers:
             - name: renovate
-              image: renovate/renovate:38
+              image: renovate/renovate:38.121-full
+              env:
+                - name: RENOVATE_CONFIG_FILE
+                  value: /etc/renovate/config.js
               envFrom:
                 - secretRef:
                     name: renovate
-                - configMapRef:
-                    name: renovate
+              volumeMounts:
+                - name: renovate-config
+                  mountPath: /etc/renovate
           restartPolicy: Never
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: renovate
-data:
-  RENOVATE_AUTODISCOVER: 'true'
-  RENOVATE_ENDPOINT: 'https://git.janky.solutions'
-  RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovatebot@janky.solutions>'
-  RENOVATE_PLATFORM: gitea
-  RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: docker run --rm -v $(pwd):/infra -w /infra git.devhack.net/devhack/containers/deployer:latest -- ./helm/render-all.sh
+          volumes:
+            - name: renovate-config
+              configMap:
+                name: renovate-config
diff --git a/renovate.json b/renovate.json
index dad00d5..9cfac90 100644
--- a/renovate.json
+++ b/renovate.json
@@ -10,9 +10,9 @@
   },
   "postUpgradeTasks": {
     "commands": [
-      "docker run --rm -v $(pwd):/infra -w /infra git.devhack.net/devhack/containers/deployer:latest -- ./helm/render-all.sh"
+      "./helm/render-all.sh"
     ],
-    "fileFilters": [
+    "fileMatch": [
       "helm/**"
     ],
     "executionMode": "update"