diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 7c235317d..000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,109 +0,0 @@
-# Automatically opens PRs for dependency updates.
-# Can be turned on and off for org or repository via "Code security and analysis" tab .
-# See https://docs.github.com/en/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts
-version: 2
-updates:
-  # Updates GHA dependencies
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: monthly
-      time: "05:00"
-      timezone: America/Los_Angeles
-    groups:
-      actions:
-        patterns:
-          - "*"
-    open-pull-requests-limit: 3
-
-  # Updates Docker dependencies
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: "05:00"
-      timezone: America/Los_Angeles
-    open-pull-requests-limit: 3
-    ignore:
-      # Ignore odd-numbered node versions because they're not LTS
-      # Have to manage this manually until https://github.com/dependabot/dependabot-core/issues/2247 is resolved
-      # Even-numbered releases also need to be ignored for the first 6 months,
-      # but there's no way to configure that in Dependabot yet
-      - dependency-name: node
-        versions: ["21.x", "23.x", "25.x", "27.x"]
-
-  # Updates Elixir dependencies
-  - package-ecosystem: mix
-    directory: server/
-    schedule:
-      interval: weekly
-      day: monday
-      time: "05:00"
-      timezone: America/Los_Angeles
-    # Will only open a maximum of 3 PRs
-    open-pull-requests-limit: 3
-
-  # Updates JavaScript dependencies
-  - package-ecosystem: npm
-    directory: /ui
-    schedule:
-      interval: weekly
-      time: "05:00"
-      timezone: America/Los_Angeles
-    open-pull-requests-limit: 3
-    # Group into fewer PRs
-    groups:
-      frameworks:
-        patterns:
-          - "next"
-          - "react"
-          - "react-dom"
-          - "@types/react"
-          - "@types/react-dom"
-      styles:
-        patterns:
-          - "@mui/*"
-          - "@emotion/*"
-          - "@fontsource/*"
-      requests:
-        patterns:
-          - "graphql"
-          - "@graphql-codegen/*"
-          - "@tanstack/react-query"
-          - "@tanstack/react-query*"
-      map:
-        patterns:
-          - "leaflet"
-          - "leaflet*"
-          - "react-leaflet"
-          - "@types/leaflet"
-      player:
-        patterns:
-          - "video.js"
-          - "videojs*"
-          - "@types/video.js"
-      code-style:
-        patterns:
-          - "eslint"
-          - "eslint*"
-          - "@typescript-eslint/*"
-          - "prettier"
-          - "lint-staged"
-          - "husky"
-      misc:
-        patterns:
-          - "*"
-        exclude-patterns:
-          # Open individual PRs for the following packages
-          - "typescript"
-          - "phoenix"
-          - "@types/node"
-    ignore:
-      # Ignore until nextjs adds eslint 9 support https://github.com/vercel/next.js/issues/64409
-      - dependency-name: "eslint"
-        versions: ["9.0 - 9.12"]
-      - dependency-name: "eslint-plugin-unused-imports"
-        versions: ["4.0 - 4.1"]
-      - dependency-name: "@typescript-eslint/eslint-plugin"
-        versions: ["8.0 - 8.9"]
diff --git a/.github/workflows/heroku.yaml b/.github/workflows/heroku.yaml
index 83e2a7d69..4b4f013b9 100644
--- a/.github/workflows/heroku.yaml
+++ b/.github/workflows/heroku.yaml
@@ -3,26 +3,22 @@ name: Heroku
 
 on:
   deployment_status:
-  issue_comment:
-    types: [created, edited]
 
 jobs:
   deployment-status:
     name: Check deployment status
     runs-on: ubuntu-latest
 
-    # Continue only if some definitive status has been reported. Also allow
-    # manual refresh of status checks by commenting '/refresh-heroku-status'.
-    if: ${{ github.event.deployment_status.state != 'pending'
-      || (contains(github.event.comment.body, '/refresh-heroku-status') && github.event.issue.pull_request) }}
+    # Continue only if some definitive status has been reported.
+    if: ${{ github.event.deployment_status.state != 'pending' }}
 
     steps:
-      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       # Forward deployment's status to the deployed commit.
-      - uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
+      - uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -38,19 +34,17 @@ jobs:
     name: Check site health
     runs-on: ubuntu-latest
 
-    # Run health check only if deployment succeeds. Also allow manual refresh
-    # of status checks by commenting '/refresh-heroku-status'.
-    if: ${{ github.event.deployment_status.state == 'success'
-      || (contains(github.event.comment.body, '/refresh-heroku-status') && github.event.issue.pull_request) }}
+    # Run health check only if deployment succeeds.
+    if: ${{ github.event.deployment_status.state == 'success' }}
 
     # Check that the deployed app returns successful HTTP response.
     steps:
-      - uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - id: health_check
-        uses: jtalk/url-health-check-action@b716ccb6645355dd9fcce8002ce460e5474f7f00 # v4
+        uses: jtalk/url-health-check-action@e7d5ebdc9027fbf494d2d034f3e8fc78f8b7a2b9 # v5
         with:
           url: ${{ github.event.deployment.payload.web_url }}
           follow-redirect: true
@@ -58,7 +52,7 @@ jobs:
           retry-delay: 30s
         continue-on-error: true
       # Set appropriate status to the deployed commit.
-      - uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
+      - uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 000000000..477c73b23
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,90 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base"],
+  "timezone": "America/Los_Angeles",
+  "packageRules": [
+    {
+      "description": "Monthly updates for GitHub Actions, grouped together",
+      "matchManagers": ["github-actions"],
+      "groupName": "actions",
+      "schedule": ["after 5am on the first day of the month"],
+      "prConcurrentLimit": 3
+    },
+    {
+      "description": "Weekly Docker dependency updates on Mondays",
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "schedule": ["after 5am on monday"],
+      "prConcurrentLimit": 3
+    },
+    {
+      "description": "Ignore odd-numbered Node.js major versions in Docker (non-LTS). Even-numbered releases are also skipped for the first 6 months, but there is no way to configure that here yet.",
+      "matchManagers": ["dockerfile"],
+      "matchPackageNames": ["node"],
+      "allowedVersions": "/^([0-9]*[02468])\\.(\\d+)/"
+    },
+    {
+      "description": "Weekly Elixir/Mix dependency updates on Mondays",
+      "matchManagers": ["mix"],
+      "schedule": ["after 5am on monday"],
+      "prConcurrentLimit": 3
+    },
+    {
+      "description": "Weekly npm dependency updates on Mondays",
+      "matchManagers": ["npm"],
+      "schedule": ["after 5am on monday"],
+      "prConcurrentLimit": 3
+    },
+    {
+      "description": "Group miscellaneous npm dependencies (catch-all, excludes packages that get individual PRs)",
+      "matchManagers": ["npm"],
+      "excludePackageNames": ["typescript", "phoenix", "@types/node"],
+      "groupName": "misc"
+    },
+    {
+      "description": "Group Next.js and React framework dependencies",
+      "matchManagers": ["npm"],
+      "matchPackageNames": ["next", "react", "react-dom", "@types/react", "@types/react-dom"],
+      "groupName": "frameworks"
+    },
+    {
+      "description": "Group MUI, Emotion, and Fontsource styling dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^@mui/", "^@emotion/", "^@fontsource/"],
+      "groupName": "styles"
+    },
+    {
+      "description": "Group GraphQL and data fetching dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^graphql$", "^@graphql-codegen/", "^@tanstack/react-query"],
+      "groupName": "requests"
+    },
+    {
+      "description": "Group Leaflet and map dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^leaflet", "^react-leaflet$", "^@types/leaflet$"],
+      "groupName": "map"
+    },
+    {
+      "description": "Group Video.js player dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^video\\.js$", "^videojs", "^@types/video\\.js$"],
+      "groupName": "player"
+    },
+    {
+      "description": "Group ESLint, Prettier, and code style dependencies",
+      "matchManagers": ["npm"],
+      "matchPackagePatterns": ["^eslint", "^@typescript-eslint/", "^prettier$", "^lint-staged$", "^husky$"],
+      "groupName": "code-style"
+    },
+    {
+      "description": "Ignore eslint-plugin-unused-imports versions 4.0 - 4.1",
+      "matchPackageNames": ["eslint-plugin-unused-imports"],
+      "allowedVersions": "< 4.0.0 || >= 4.2.0"
+    },
+    {
+      "description": "Ignore @typescript-eslint/eslint-plugin versions 8.0 - 8.9",
+      "matchPackageNames": ["@typescript-eslint/eslint-plugin"],
+      "allowedVersions": "< 8.0.0 || >= 8.10.0"
+    }
+  ]
+}