diff --git a/.gitea/workflows/check-renovate.yml.hold b/.gitea/workflows/check-renovate.yml.hold
new file mode 100644
index 00000000..1721d46b
--- /dev/null
+++ b/.gitea/workflows/check-renovate.yml.hold
@@ -0,0 +1,20 @@
+name: Check Renovate Updates
+
+on:
+  pull_request:
+    branches:
+      - main
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'docker-compose.yml'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    if: ${{ contains(toLower(github.event.pull_request.user.login), 'renovate') }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Validate docker-compose.yml
+        run: docker compose config
diff --git a/.gitea/workflows/renovate-pr-deploy.yml.hold b/.gitea/workflows/renovate-pr-deploy.yml.hold
new file mode 100644
index 00000000..eaea2af5
--- /dev/null
+++ b/.gitea/workflows/renovate-pr-deploy.yml.hold
@@ -0,0 +1,98 @@
+name: Deploy Renovate Updates
+
+on:
+  workflow_run:
+    workflows: ["Check Renovate Updates"]
+    types:
+      - completed
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    if: >
+      ${{
+        github.event.workflow_run.conclusion == 'success' &&
+        contains(toLower(github.event.workflow_run.head_commit.author.name), 'renovate')
+      }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # we need full history to compute merge-base
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker (if needed)
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Install yq
+        run: |
+          sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq
+          sudo chmod +x /usr/bin/yq
+
+      - name: Get modified services including dependencies
+        id: modified_services
+        run: |
+          echo "Finding modified services in docker-compose.yml..."
+
+          # Find merge-base with previous main commit
+          BASE_COMMIT=$(git merge-base HEAD HEAD~1)
+
+          # Extract changed services between merge-base and HEAD
+          CHANGED_SERVICES=$(git diff --name-only $BASE_COMMIT HEAD -- docker-compose.yml \
+            | xargs -r -I{} yq e '.services | keys | .[]' {})
+
+          if [ -z "$CHANGED_SERVICES" ]; then
+            echo "No services changed, skipping."
+            exit 0
+          fi
+
+          declare -A VISITED
+          ALL_DEPLOY=()
+
+          get_deps() {
+            local service=$1
+            if [[ -n "${VISITED[$service]}" ]]; then
+              return
+            fi
+            VISITED[$service]=1
+            ALL_DEPLOY+=("$service")
+
+            # Array style depends_on
+            deps=$(yq e ".services.\"$service\".depends_on[]?" docker-compose.yml 2>/dev/null)
+            for dep in $deps; do
+              get_deps "$dep"
+            done
+
+            # Mapping style depends_on (with condition)
+            deps_map=$(yq e ".services.\"$service\".depends_on | keys[]" docker-compose.yml 2>/dev/null)
+            for dep in $deps_map; do
+              get_deps "$dep"
+            done
+          }
+
+          for svc in $CHANGED_SERVICES; do
+            get_deps "$svc"
+          done
+
+          echo "Services to deploy: ${ALL_DEPLOY[@]}"
+          echo "modified_services=${ALL_DEPLOY[@]}" >> $GITHUB_ENV
+
+      - name: Pull images for modified services
+        if: env.modified_services != ''
+        run: |
+          echo "Pulling images for services: $modified_services"
+          for svc in $modified_services; do
+            docker compose pull $svc || echo "Failed to pull $svc, continuing..."
+          done
+
+      - name: Deploy updated services
+        if: env.modified_services != ''
+        run: |
+          echo "Deploying services: $modified_services"
+          docker compose up -d $modified_services