diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b891d43..aca2b51 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -90,11 +90,18 @@ jobs:
       - name: Assert pinned install
         env:
           VERSION: ${{ steps.pinned.outputs.mergify_cli_version }}
+          # Must equal the with: input above; Renovate bumps both on each
+          # mergify-cli release. Kept as a separate literal (not derived from
+          # the input) so the assertion checks against a fixed expectation. The
+          # name is mergify-specific so the Renovate customManager that bumps it
+          # cannot collide with any other digit-led env added here later.
+          EXPECTED_MERGIFY_CLI_VERSION: 2026.7.21.1
         run: |
-          # Compare against the literal requested version (not the action's own
-          # readback), so a regression that installs the wrong version fails CI.
-          test "$VERSION" = "2026.7.21.1"
-          test "$(mergify --version | awk '{print $NF}')" = "2026.7.21.1"
+          # Compare against the expected literal requested version (not the
+          # action's own readback), so a regression that installs the wrong
+          # version fails CI.
+          test "$VERSION" = "$EXPECTED_MERGIFY_CLI_VERSION"
+          test "$(mergify --version | awk '{print $NF}')" = "$EXPECTED_MERGIFY_CLI_VERSION"
 
       - name: Install latest mergify-cli
         id: latest
diff --git a/renovate.json b/renovate.json
index 3d91408..f9b3aff 100644
--- a/renovate.json
+++ b/renovate.json
@@ -44,6 +44,20 @@
       "depNameTemplate": "Mergifyio/mergify-cli",
       "versioningTemplate": "pep440"
     },
+    {
+      "description": "Bump the mergify_cli_version pinned in the ci.yaml dogfooding test on each mergify-cli release, so it lands in the same PR as the action.yml default + README.md table and the three stay aligned. The two matchStrings are anchored to the mergify-specific `mergify_cli_version:` input and `EXPECTED_MERGIFY_CLI_VERSION:` assertion env; both tolerate an optional YAML quote and require a digit-led value, so they cannot collide with an unrelated env and leave the neighbouring `latest` install test untouched.",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.github/workflows/ci\\.yaml$/"
+      ],
+      "matchStrings": [
+        "mergify_cli_version: \"?(?<currentValue>\\d[^\\s\"]+)",
+        "EXPECTED_MERGIFY_CLI_VERSION: \"?(?<currentValue>\\d[^\\s\"]+)"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "Mergifyio/mergify-cli",
+      "versioningTemplate": "pep440"
+    },
     {
       "description": "Bump the self-referenced action version pinned in the README usage example on each new setup-cli release.",
       "customType": "regex",