diff --git a/.gitattributes b/.gitattributes
index 231f6ea..76532e4 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -47,7 +47,7 @@ Makefile text eol=lf
 .git-blame-ignore-revs export-ignore
 .editorconfig export-ignore
 Makefile export-ignore
-renovate.json export-ignore
+renovate.json5 export-ignore
 tests/ export-ignore
 examples/ export-ignore
 tools/ export-ignore
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index bf10f0c..13d38bd 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -19,5 +19,5 @@ install.sh                      @FZ2000
 install_schedule.sh             @FZ2000
 pyproject.toml                  @FZ2000
 .github/                        @FZ2000
-renovate.json                   @FZ2000
+renovate.json5                  @FZ2000
 .gitignore                      @FZ2000
diff --git a/renovate.json b/renovate.json
deleted file mode 100644
index ad213e2..0000000
--- a/renovate.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
-  "schedule": ["before 6am on Monday"],
-  "labels": ["dependencies"],
-  "commitMessagePrefix": "chore(deps)",
-  "commitMessageTopic": "{{depName}}",
-  "prConcurrentLimit": 5,
-  "prHourlyLimit": 2,
-  "rangeStrategy": "bump",
-  "configMigration": true,
-  "pre-commit": {
-    "enabled": true
-  },
-  "customManagers": [
-    {
-      "customType": "regex",
-      "managerFilePatterns": ["/^\\.github/workflows/[^/]+\\.ya?ml$/"],
-      "matchStrings": [
-        "gitleaks/gitleaks/releases/download/v(?<currentValue>[0-9.]+)/",
-        "trufflesecurity/trufflehog/releases/download/v(?<currentValue>[0-9.]+)/",
-        "lycheeverse/lychee/releases/download/lychee-v(?<currentValue>[0-9.]+)/",
-        "markdownlint-cli@(?<currentValue>[0-9.]+)"
-      ],
-      "depNameTemplate": "ci-pinned-tools",
-      "datasourceTemplate": "github-releases",
-      "versioningTemplate": "semver"
-    }
-  ],
-  "packageRules": [
-    {
-      "groupName": "python dev tooling",
-      "matchManagers": ["pep621"],
-      "matchPackageNames": ["/^(ruff|mypy|pytest|pytest-cov)$/"]
-    },
-    {
-      "groupName": "CI actions",
-      "matchManagers": ["github-actions"],
-      "matchPackageNames": ["/^actions\\//"]
-    },
-    {
-      "groupName": "pre-commit hooks",
-      "matchManagers": ["pre-commit"]
-    }
-  ]
-}
diff --git a/renovate.json5 b/renovate.json5
new file mode 100644
index 0000000..a275fbf
--- /dev/null
+++ b/renovate.json5
@@ -0,0 +1,75 @@
+{
+  // JSON5 rather than JSON so this file can explain itself. Renovate reads
+  // renovate.json5 natively; plain JSON has no comment syntax, and the
+  // `_comment` key workaround trips Renovate's unknown-option validation.
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+
+  extends: ["config:recommended", "helpers:pinGitHubActionDigests"],
+  schedule: ["before 6am on Monday"],
+  labels: ["dependencies"],
+  commitMessagePrefix: "chore(deps)",
+  commitMessageTopic: "{{depName}}",
+  prConcurrentLimit: 5,
+  prHourlyLimit: 2,
+  rangeStrategy: "bump",
+  configMigration: true,
+
+  // Off by default, so the five hook revs in .pre-commit-config.yaml would
+  // never be bumped without this.
+  "pre-commit": { enabled: true },
+
+  customManagers: [
+    {
+      // CI curl-downloads three tools from GitHub releases and runs one via
+      // npx. None is visible to a built-in manager, so without these they
+      // stay pinned forever.
+      //
+      // depName is CAPTURED from the URL, never templated to a literal. An
+      // earlier version of this file set depNameTemplate to the invented
+      // name "ci-pinned-tools", and Renovate reported exactly that:
+      //   Failed to look up github-releases package ci-pinned-tools: no-result
+      // A datasource lookup needs a real package name.
+      customType: "regex",
+      managerFilePatterns: ["/^\\.github/workflows/[^/]+\\.ya?ml$/"],
+      matchStrings: [
+        "https://github\\.com/(?<depName>[^/\"]+/[^/\"]+)/releases/download/v(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)/",
+      ],
+      datasourceTemplate: "github-releases",
+      versioningTemplate: "semver",
+    },
+    {
+      // lychee tags its releases `lychee-vX.Y.Z`, not `vX.Y.Z`, so it needs
+      // its own matchString and an extractVersion to recover the bare
+      // version from the tag name.
+      customType: "regex",
+      managerFilePatterns: ["/^\\.github/workflows/[^/]+\\.ya?ml$/"],
+      matchStrings: [
+        "https://github\\.com/(?<depName>lycheeverse/lychee)/releases/download/lychee-v(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)/",
+      ],
+      datasourceTemplate: "github-releases",
+      extractVersionTemplate: "^lychee-v(?<version>.+)$",
+      versioningTemplate: "semver",
+    },
+    {
+      // markdownlint-cli arrives via npx, so it is an npm package. The
+      // previous config asked the github-releases datasource for it, which
+      // could never have resolved.
+      customType: "regex",
+      managerFilePatterns: ["/^\\.github/workflows/[^/]+\\.ya?ml$/"],
+      matchStrings: ["(?<depName>markdownlint-cli)@(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)"],
+      datasourceTemplate: "npm",
+      versioningTemplate: "semver",
+    },
+  ],
+
+  packageRules: [
+    {
+      groupName: "python dev tooling",
+      matchManagers: ["pep621"],
+      matchPackageNames: ["/^(ruff|mypy|pytest|pytest-cov)$/"],
+    },
+    { groupName: "CI actions", matchManagers: ["github-actions"], matchPackageNames: ["actions/**"] },
+    { groupName: "pre-commit hooks", matchManagers: ["pre-commit"] },
+    { groupName: "CI pinned tools", matchManagers: ["custom.regex"] },
+  ],
+}