diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100755
index 00000000..df3022d9
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,10 @@
+#!/bin/sh
+# Regenerate NOTICE.txt whenever package.json or package-lock.json is staged.
+# This keeps the file accurate for both manual dependency bumps and automated
+# tool runs (e.g. `npm install`) that stage lockfile changes.
+
+if git diff --cached --name-only | grep -qE '^package(-lock)?\.json$'; then
+  echo "package.json or package-lock.json changed — regenerating NOTICE.txt..."
+  node scripts/generate-notice.mjs
+  git add NOTICE.txt
+fi
diff --git a/package.json b/package.json
index ae2de96b..d4474b83 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,7 @@
     "packages/*"
   ],
   "scripts": {
+    "prepare": "git config core.hooksPath .githooks || true",
     "build": "node --max-old-space-size=6144 node_modules/typescript/bin/tsc -b",
     "test": "npm run build && npm run test:unit && npm run test:license",
     "test:unit": "node --import tsx/esm --test --experimental-test-coverage --test-coverage-lines=90 --test-coverage-branches=90 --test-coverage-functions=90 --test-coverage-include='src/**/*.ts' --test-coverage-include='packages/*/src/**/*.ts' --test-coverage-exclude='src/cloud/apis/**' --test-coverage-exclude='src/es/apis.ts' --test-coverage-exclude='src/es/api-manifest.ts' --test-coverage-exclude='src/es/apis/**' --test-coverage-exclude='src/cloud/apis.ts' --test-coverage-exclude='src/cloud/serverless-apis.ts' --test-coverage-exclude='node_modules/**'",
diff --git a/renovate.json b/renovate.json
index 591ec645..3ffbe7bf 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,5 +2,10 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "local>elastic/renovate-config"
-  ]
+  ],
+  "postUpgradeTasks": {
+    "commands": ["node scripts/generate-notice.mjs"],
+    "fileFilters": ["NOTICE.txt"],
+    "executionMode": "branch"
+  }
 }