diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6da05b0..5598a7c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,11 @@ updates:
       # devantler-tech actions/workflows are our own code — bump now, no cooldown.
       exclude:
         - "devantler-tech/*"
+  - package-ecosystem: opentofu
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    cooldown:
+      # Third-party provider releases wait a week, as third-party actions do.
+      default-days: 7
diff --git a/README.md b/README.md
index d36e8fd..8b801ef 100644
--- a/README.md
+++ b/README.md
@@ -93,19 +93,16 @@ variables. Keep all three out of shell history and repository files.
 
 ## Dependency updates
 
-This repository configures Renovate to propose Cloudflare provider updates
-and maintain the OpenTofu lock file using `registry.opentofu.org`. Provider versions remain exact pins;
-updates require the existing CI and review gates and are never auto-merged.
-Dependabot continues to manage GitHub Actions.
-
-The OpenTofu runtime stays on the reviewed 1.12.x line. Renovate's Terraform
-runtime updates are disabled because they track a different product. Every
-provider proposal must pass `scripts/test.sh`, including the destructive-plan
-guard. Dependency automation has no production credentials or apply path.
-
-Validate changes to these rules with Renovate's repository configuration
-validator on its supported Node 24 runtime:
-
-```sh
-npx --yes --package=renovate@44.125.1 renovate-config-validator --no-global --strict renovate.json
-```
+Dependabot proposes updates to the Cloudflare provider and to the GitHub
+Actions this repository uses, as configured in `.github/dependabot.yml`. For
+the provider it uses its OpenTofu support, which also refreshes the provider
+checksums in `.terraform.lock.hcl`. Provider versions remain exact pins. A new
+third-party release waits seven days before Dependabot proposes it as a version
+update; the wait does not apply to Dependabot security updates, which GitHub
+offers for the Actions but not for OpenTofu providers. Updates require the
+existing CI and review gates and are never auto-merged.
+
+The OpenTofu runtime stays on the reviewed 1.12.x line; no updater changes it.
+Every provider proposal must pass `scripts/test.sh`, including the
+destructive-plan guard. Dependency automation has no production credentials or
+apply path.
diff --git a/renovate.json b/renovate.json
deleted file mode 100644
index f10670a..0000000
--- a/renovate.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "enabledManagers": ["terraform"],
-  "dependencyDashboard": false,
-  "semanticCommits": "enabled",
-  "automerge": false,
-  "ignoreDeps": ["hashicorp/terraform"],
-  "packageRules": [
-    {
-      "matchDatasources": ["terraform-provider"],
-      "registryUrls": ["https://registry.opentofu.org"],
-      "rangeStrategy": "pin"
-    }
-  ],
-  "lockFileMaintenance": {
-    "enabled": true
-  }
-}