diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..586e006c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "npm" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"
+      time: "07:00"
+      timezone: "Pacific/Auckland"
+    assignees:
+      - "kirk-spragg" # Security Champion for DevOps.
+    cooldown:
+      default-days: 4
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 00000000..6f74b031
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,30 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", "group:allNonMajor", "schedule:monthly"],
+  "timezone": "Pacific/Auckland",
+  "labels": ["dependencies"],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "automerge": false,
+    "schedule": ["every 3 months on the first day of the month"]
+  },
+  "minimumReleaseAge": "4 days",
+  "prCreation": "not-pending",
+  "packageRules": [
+    {
+      "matchDepTypes": ["devDependencies"],
+      "automerge": false
+    },
+    {
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+      "automerge": false
+    },
+    {
+      "matchUpdateTypes": ["major"]
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "labels": ["security"],
+    "automerge": false
+  }
+}