diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000000000..71c6301f8e0c2
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,40 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "github>elastic/renovate-config:only-chainguard",
+    ":disableDependencyDashboard"
+  ],
+  "schedule": [
+    "after 1pm on tuesday"
+  ],
+  "labels": [">non-issue", ":Delivery/Packaging", "Team:Delivery", "auto-merge-without-approval"],
+  "baseBranches": ["main", "8.x", "8.17", "8.16"],
+  "packageRules": [
+    {
+      "groupName": "wolfi (versioned)",
+      "groupSlug": "wolfi-versioned",
+      "description": "Override the `groupSlug` to create a non-special-character branch name",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackagePatterns": [
+        "^docker.elastic.co/wolfi/chainguard-base$"
+      ]
+    }
+  ],
+  "customManagers": [
+    {
+      "description": "Extract Wolfi images from elasticsearch DockerBase configuration",
+      "customType": "regex",
+      "fileMatch": [
+        "build\\-tools\\-internal\\/src\\/main\\/java\\/org\\/elasticsearch\\/gradle\\/internal\\/DockerBase\\.java$"
+      ],
+      "matchStrings": [
+        "\\s*\"?(?<depName>[^\\s:@\"]+)(?::(?<currentValue>[-a-zA-Z0-9.]+))?(?:@(?<currentDigest>sha256:[a-zA-Z0-9]+))?\"?"
+      ],
+      "currentValueTemplate": "{{#if currentValue}}{{{currentValue}}}{{else}}latest{{/if}}",
+      "autoReplaceStringTemplate": "{{{depName}}}{{#if newValue}}:{{{newValue}}}{{/if}}{{#if newDigest}}@{{{newDigest}}}{{/if}}\"",
+      "datasourceTemplate": "docker"
+    }
+  ]
+}