diff --git a/mise.lock b/mise.lock
index 6d3650e..2cd6435 100644
--- a/mise.lock
+++ b/mise.lock
@@ -106,7 +106,7 @@ checksum = "sha256:57f71ab3652e797d84acddc79c81cc9ff1c6ddb2a1974cdb83f00fee9bff4
 url = "https://nodejs.org/dist/v24.19.0/node-v24.19.0-win-x64.zip"
 
 [[tools."npm:renovate"]]
-version = "44.11.6"
+version = "44.37.1"
 backend = "npm:renovate"
 
 [tools."npm:renovate".options]
diff --git a/mise.toml b/mise.toml
index ff7f89b..713e151 100644
--- a/mise.toml
+++ b/mise.toml
@@ -47,7 +47,7 @@ node = "24.19.0"
 # latest is a benign manual publish missing the provenance its CI releases had.
 "npm:renovate" = { trust_policy_excludes = [
   "@yarnpkg/libzip",
-], version = "44.11.6" }
+], version = "44.37.1" }
 pkl = "0.32.1"
 # Deliberately duplicates `packageManager` in package.json (turbo requires
 # that field). Renovate groups both bumps into one PR — see the "pnpm"