diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 7c3e01d..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    allow:
-      - dependency-type: "all"
-    directory: "/"
-    labels:
-      - "dependabot"
-    open-pull-requests-limit: 1
-    schedule:
-      interval: "weekly"
diff --git a/.github/workflows/renovatebot.yml b/.github/workflows/renovatebot.yml
new file mode 100644
index 0000000..9519228
--- /dev/null
+++ b/.github/workflows/renovatebot.yml
@@ -0,0 +1,28 @@
+name: Renovate
+
+on:
+  push:
+    branches: ["main"]
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    - cron: "14 3 * * 1-5"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run renovatebot
+        uses: renovatebot/github-action@v40.1.11
+        env:
+          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.GPG_SIGNING_KEY }}
+          RENOVATE_REPOSITORIES: "robert-koch-institut/mex-template"
+        with:
+          configurationFile: renovate.json
+          token: ${{ secrets.WORKFLOW_TOKEN }}
diff --git a/.gitignore b/.gitignore
index 1a65936..bc0e810 100644
--- a/.gitignore
+++ b/.gitignore
@@ -116,3 +116,10 @@ dmypy.json
 
 # SQLite databases
 *.db
+
+# Default exports
+*.ndjson
+data/
+identity.csv
+schema.json
+work/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6942151..a995a9b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,14 +9,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- configure renovatebot for mex-template itself
+
 ### Changes
 
+- harmonize git and docker ignore files
+- update requirements, actions and sample dependencies
+
 ### Deprecated
 
 ### Removed
 
 ### Fixed
 
+- fix `export-all` pdm script
+
 ### Security
 
 ## [0.2.0] - 2024-04-30
diff --git a/mex-{{ cookiecutter.project_name }}/.dockerignore b/mex-{{ cookiecutter.project_name }}/.dockerignore
index 284f9da..a982909 100644
--- a/mex-{{ cookiecutter.project_name }}/.dockerignore	
+++ b/mex-{{ cookiecutter.project_name }}/.dockerignore	
@@ -112,6 +112,13 @@ dmypy.json
 # SQLite databases
 *.db
 
+# Default exports
+*.ndjson
+data/
+identity.csv
+schema.json
+work/
+
 # Docker specifics
 **/.dockerignore
 **/.git
diff --git a/mex-{{ cookiecutter.project_name }}/.github/workflows/docker.yml b/mex-{{ cookiecutter.project_name }}/.github/workflows/docker.yml
index 37d3775..95363df 100644
--- a/mex-{{ cookiecutter.project_name }}/.github/workflows/docker.yml	
+++ b/mex-{{ cookiecutter.project_name }}/.github/workflows/docker.yml	
@@ -11,4 +11,4 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Build, tag and push docker image to ghcr
-        uses: GlueOps/github-actions-build-push-containers@v0.3
+        uses: GlueOps/github-actions-build-push-containers@v0.4
diff --git a/mex-{{ cookiecutter.project_name }}/.github/workflows/documentation.yml b/mex-{{ cookiecutter.project_name }}/.github/workflows/documentation.yml
index 703597a..4b38061 100644
--- a/mex-{{ cookiecutter.project_name }}/.github/workflows/documentation.yml	
+++ b/mex-{{ cookiecutter.project_name }}/.github/workflows/documentation.yml	
@@ -55,7 +55,7 @@ jobs:
           python-version: 3.11
 
       - name: Setup pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@v5
 
       - name: Install requirements
         run: make install
diff --git a/mex-{{ cookiecutter.project_name }}/.github/workflows/renovatebot.yml b/mex-{{ cookiecutter.project_name }}/.github/workflows/renovatebot.yml
index 8a8167a..4c2f823 100644
--- a/mex-{{ cookiecutter.project_name }}/.github/workflows/renovatebot.yml	
+++ b/mex-{{ cookiecutter.project_name }}/.github/workflows/renovatebot.yml	
@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 1
 
       - name: Run renovatebot
-        uses: renovatebot/github-action@v40.1.9
+        uses: renovatebot/github-action@v40.1.11
         env:
           RENOVATE_GIT_PRIVATE_KEY: {% raw %}${{ secrets.GPG_SIGNING_KEY }}{% endraw %}
           RENOVATE_REPOSITORIES: "robert-koch-institut/mex-{{ cookiecutter.project_name }}"
diff --git a/mex-{{ cookiecutter.project_name }}/.gitignore b/mex-{{ cookiecutter.project_name }}/.gitignore
index 1a65936..bc0e810 100644
--- a/mex-{{ cookiecutter.project_name }}/.gitignore	
+++ b/mex-{{ cookiecutter.project_name }}/.gitignore	
@@ -116,3 +116,10 @@ dmypy.json
 
 # SQLite databases
 *.db
+
+# Default exports
+*.ndjson
+data/
+identity.csv
+schema.json
+work/
diff --git a/mex-{{ cookiecutter.project_name }}/pyproject.toml b/mex-{{ cookiecutter.project_name }}/pyproject.toml
index d781852..d08630c 100644
--- a/mex-{{ cookiecutter.project_name }}/pyproject.toml	
+++ b/mex-{{ cookiecutter.project_name }}/pyproject.toml	
@@ -9,15 +9,15 @@ urls = { Repository = "https://github.com/robert-koch-institut/mex-{{ cookiecutt
 requires-python = "<3.13,>=3.11"
 dependencies = []
 optional-dependencies.dev = [
-    "black==24.3.0",
-    "ipdb==0.13.13",
-    "mypy==1.9.0",
-    "pytest-cov==4.1.0",
-    "pytest-random-order==1.1.1",
-    "pytest-xdist==3.5.0",
-    "pytest==8.1.1",
-    "ruff==0.3.5",
-    "sphinx==7.2.6",
+    "black>=24.4.2",
+    "ipdb>=0.13.13",
+    "mypy>=1.10.0",
+    "pytest-cov>=5.0.0",
+    "pytest-random-order>=1.1.1",
+    "pytest-xdist>=3.6.1",
+    "pytest>=8.2.0",
+    "ruff>=0.4.4",
+    "sphinx>=7.3.7",
 ]
 
 [project.scripts]
@@ -43,7 +43,7 @@ distribution = true
 update-all = { cmd = "pdm update --group :all --update-eager --save-minimum" }
 lock-all = { cmd = "pdm lock --group :all" }
 install-all = { cmd = "pdm install --group :all" }
-export-all = { cmd = "pdm export --all :all -f requirements" }
+export-all = { cmd = "pdm export --group :all -f requirements" }
 apidoc = { cmd = "pdm run sphinx-apidoc -f -o docs/source mex" }
 sphinx = { cmd = "pdm run sphinx-build -aE -b dirhtml docs docs/dist" }
 doc = { composite = ["apidoc", "sphinx"] }
@@ -54,7 +54,6 @@ unit = { cmd = "pdm run pytest -m 'not integration'" }
 test = { cmd = "pdm run pytest --numprocesses=auto --dist=worksteal" }
 all = { composite = ["install-all", "lint", "test", "doc"] }
 
-
 [tool.pydantic-mypy]
 warn_untyped_fields = true
 
@@ -127,5 +126,5 @@ known-first-party = ["mex", "tests"]
 convention = "google"
 
 [build-system]
-requires = ["pdm-backend==2.1.8"]
+requires = ["pdm-backend>=2.3.0"]
 build-backend = "pdm.backend"
diff --git a/mex-{{ cookiecutter.project_name }}/requirements.txt b/mex-{{ cookiecutter.project_name }}/requirements.txt
index 8295f45..712004a 100644
--- a/mex-{{ cookiecutter.project_name }}/requirements.txt	
+++ b/mex-{{ cookiecutter.project_name }}/requirements.txt	
@@ -1,4 +1,4 @@
 cruft==2.15.0
-pdm==2.13.2
-pre-commit==3.7.0
+pdm==2.15.2
+pre-commit==3.7.1
 wheel==0.43.0
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..29bddbf
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,30 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "enabledManagers": [
+        "github-actions",
+        "html",
+        "npm",
+        "pep621",
+        "pip_requirements"
+    ],
+    "gitAuthor": "RKIMetadataExchange <mex@rki.de>",
+    "lockFileMaintenance": {
+        "enabled": true,
+        "schedule": [
+            "before 4am on monday"
+        ]
+    },
+    "packageRules": [
+        {
+            "matchUpdateTypes": [
+                "digest",
+                "lockFileMaintenance",
+                "major",
+                "minor",
+                "patch",
+                "pin"
+            ],
+            "minimumReleaseAge": "7 days"
+        }
+    ]
+}