diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
new file mode 100644
index 000000000..036ec0492
--- /dev/null
+++ b/.github/workflows/renovate.yml
@@ -0,0 +1,31 @@
+name: Renovate
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.sha }}
+  cancel-in-progress: true
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Renovate
+        uses: renovatebot/github-action@v46.0.2
+        with:
+          configurationFile: renovate.json
+          token: ${{ secrets.PAT_TOKEN }}
+  renovate-check:
+    if: always()
+    needs:
+      - renovate
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - name: Alls Green
+        uses: re-actors/alls-green@release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index df1cf7ebe..784069d99 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -1,7 +1,8 @@
 name: Upgrade
 on:
+  pull_request:
   schedule:
-    - cron: '0 2 * * *'
+    - cron: '0 3 * * *'
   workflow_dispatch:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.sha }}
@@ -21,11 +22,12 @@ jobs:
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
       - name: Run Upgrade
-        run: make upgrade
+        run: make upgrade-dev
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SKIP_HOME_MANAGER_SWITCH: "true"
       - name: Create Pull Request
+        if: github.action != 'pull_request'
         id: cpr
         uses: peter-evans/create-pull-request@v8
         with:
diff --git a/Makefile b/Makefile
index e21727ac5..226729b07 100644
--- a/Makefile
+++ b/Makefile
@@ -208,6 +208,11 @@ update-local-binaries: ## Update and rebuild local binaries from .local-binaries
 .PHONY: upgrade
 upgrade: nix-upgrade overlays-upgrade neovim-upgrade ## Upgrade Nix flake, overlays, Neovim plugins
 
+.PHONY: upgrade-dev
+upgrade-dev: ## Upgrade inside the Nix dev shell (mirrors CI).
+	@echo "🔄 Running upgrade inside the Nix dev shell..."
+	@DEVENV_ROOT=$(CURDIR) $(NIX_ALLOW_UNFREE) $(NIX_EXEC) develop $(NIX_FLAGS) .# --command $(MAKE) upgrade
+
 .PHONY: dev
 dev: nix-develop ## Enter the Nix dev shell (alias for nix-develop).
 
diff --git a/config/ghostty/default.nix b/config/ghostty/default.nix
index caeaf8555..b8d9bb528 100644
--- a/config/ghostty/default.nix
+++ b/config/ghostty/default.nix
@@ -2,10 +2,7 @@
 let
   fishPath = "${pkgs.fish}/bin/fish";
   staticConfig = builtins.readFile ./config;
-  configText = builtins.replaceStrings
-    [ "__FISH_PATH__" ]
-    [ fishPath ]
-    staticConfig;
+  configText = builtins.replaceStrings [ "__FISH_PATH__" ] [ fishPath ] staticConfig;
 in
 {
   xdg.configFile."ghostty/config" = {