diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 40708289..fc69a96c 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -13,7 +13,7 @@ jobs:
         RENOVATE_REPOSITORIES: '["${{ github.repository }}"]'
         RENOVATE_REPOSITORY_CACHE: enabled
         RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-      image: ghcr.io/renovatebot/renovate:37.225.0-full
+      image: ghcr.io/renovatebot/renovate:37.229.3-full@sha256:2b8a2f01735edbce6891a93660131921fdb7d18c4e368fdc6bc5069b8a9e2ee5
       options: '--user root'
     runs-on: ubuntu-22.04
     steps:
diff --git a/.gitlab/workflows/renovate.yml b/.gitlab/workflows/renovate.yml
index 8bc69b5c..bbc90f19 100644
--- a/.gitlab/workflows/renovate.yml
+++ b/.gitlab/workflows/renovate.yml
@@ -3,7 +3,7 @@ renovate:
     key: ${CI_COMMIT_REF_SLUG}-renovate
     paths:
       - renovate/cache/renovate/repository/
-  image: renovate/renovate:37.225.0-full
+  image: renovate/renovate:37.229.3-full@sha256:2b8a2f01735edbce6891a93660131921fdb7d18c4e368fdc6bc5069b8a9e2ee5
   rules:
     - if: $CI_PIPELINE_SOURCE == "schedule" && $RENOVATE_TOKEN != null
   script: renovate $RENOVATE_EXTRA_FLAG