diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 8ced7a3..e22e314 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -9,6 +9,8 @@ on:
   schedule:
   - cron: '21 3 * * 3'
 
+permissions: read-all
+
 jobs:
   analyze:
     name: Analyze
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..a85e67e
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", ":dependencyDashboard"],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 0,
+  "branchConcurrentLimit": 0,
+  "ignorePaths": ["**/test/**"],
+  "sveltos": {
+    "fileMatch": ["^.*\\.yaml$"]
+  }
+}