diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0abedefd..51e995de 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@
 
 ### Fixed
 - Fixed Cargo Deny failure with updating to version 0.19.1 ([#1140](https://github.com/opendevstack/ods-quickstarters/issues/1140))
+- Moving tokens into Kubernetes Secrets and narrowing permissions
 
 ## [4.12.1] - 2026-03-16
 ### Fixed
diff --git a/docs/modules/quickstarters/pages/renovate.adoc b/docs/modules/quickstarters/pages/renovate.adoc
new file mode 100644
index 00000000..4e137d19
--- /dev/null
+++ b/docs/modules/quickstarters/pages/renovate.adoc
@@ -0,0 +1,40 @@
+= Renovate
+
+== Purpose of this quickstarter
+
+Use this for automating dependency updates in software projects. Lives in your cd-namespace.
+
+== What files / which architecture is generated?
+
+----
+├── README.md
+├── chart
+│   ├── Chart.lock
+│   ├── Chart.yaml
+│   ├── charts
+│   │   └── renovate-46.8.4.tgz
+│   ├── templates
+│   │   ├── configmap.yaml
+│   │   └── secret.yaml
+│   ├── values.yaml
+│   └── values.yaml.secret.example
+├── import-certs.sh
+├── metadata.yml
+└── release-manager.yml
+----
+
+== Frameworks used
+
+* https://docs.renovatebot.com[Renovate]
+
+== Usage - How do you start after you provisioned this quickstarter?
+
+See README.
+
+== Jenkins agent image used
+
+ods/jenkins-agent-base:4.x
+
+== Known limitations
+
+Let us know if you find any. Feel free to open issues and pull requests, thank you!
diff --git a/renovate/Dockerfile.template b/renovate/Dockerfile.template
index 35ec70cc..6237d523 100644
--- a/renovate/Dockerfile.template
+++ b/renovate/Dockerfile.template
@@ -12,9 +12,14 @@ COPY import-certs.sh /usr/local/bin/import-certs.sh
 RUN chmod +x /usr/local/bin/import-certs.sh
 
 # Required for import-certs.sh and update-ca-certificates to work at runtime
-RUN chmod -R 777 /usr/local/share/ca-certificates && \
-    chmod 777 /etc/ssl/certs && \
-    chmod 666 /etc/ca-certificates.conf
+# Recursive only on /usr/local/share/ca-certificates (needs to write cert files there).
+# /etc/ssl/certs and /etc/ca-certificates.conf: directory/file ownership only — existing
+# system cert files stay root-owned, limiting write surface if container is compromised.
+# ca-certificates.crt is the bundle output file rewritten by update-ca-certificates — must be writable.
+RUN chown -R 12021 /usr/local/share/ca-certificates \
+    && chown 12021 /etc/ssl/certs \
+    && chown 12021 /etc/ssl/certs/ca-certificates.crt \
+    && chown 12021 /etc/ca-certificates.conf
 
 # This is required because Node.js doesn't use the system CA store by default
 ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt    
@@ -23,4 +28,4 @@ ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
 USER 12021
 
 # Debug mode: set -x to show all commands in logs for troubleshooting
-ENTRYPOINT [ "/bin/sh", "-c", "set -x; /usr/local/bin/import-certs.sh && exec /usr/local/sbin/renovate-entrypoint.sh" ]
\ No newline at end of file
+ENTRYPOINT [ "/bin/sh", "-c", "set -x; /usr/local/bin/import-certs.sh && exec /usr/local/sbin/renovate-entrypoint.sh" ]
diff --git a/renovate/files/chart/Chart.lock b/renovate/files/chart/Chart.lock
index e05f854a..88e444ee 100644
--- a/renovate/files/chart/Chart.lock
+++ b/renovate/files/chart/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: renovate
-  repository: https://docs.renovatebot.com/helm-charts
-  version: 45.71.2
-digest: sha256:c90afb616b7e68bea19917cb126b6e5b3e521c4e3cd72f28b3758a5219801509
-generated: "2026-01-12T08:38:13.079663+01:00"
+  repository: oci://ghcr.io/renovatebot/charts
+  version: 46.8.4
+digest: sha256:7d84ee87486bae4ec4ea6698390f686017f8e0c278fd2f6ee4a83cd992149465
+generated: "2026-06-15T08:26:49.837033+02:00"
diff --git a/renovate/files/chart/templates/secret.yaml b/renovate/files/chart/templates/secret.yaml
new file mode 100644
index 00000000..d87caf00
--- /dev/null
+++ b/renovate/files/chart/templates/secret.yaml
@@ -0,0 +1,9 @@
+{{- if .Values.github.token }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: renovate-github-token
+type: Opaque
+stringData:
+  GITHUB_TOKEN: {{ .Values.github.token | quote }}
+{{- end }}
diff --git a/renovate/files/chart/values.yaml b/renovate/files/chart/values.yaml
index 886efb15..6fdf90b1 100644
--- a/renovate/files/chart/values.yaml
+++ b/renovate/files/chart/values.yaml
@@ -29,6 +29,12 @@ renovate:
         secretKeyRef:
           name: cd-user-with-password
           key: password
+    - name: GITHUB_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: renovate-github-token
+          key: GITHUB_TOKEN
+          optional: true
 
   # -- Additional volumes to the pod
   extraVolumes:
@@ -51,3 +57,8 @@ renovate:
       cache:
         # -- Allow the cache to persist between runs
         enabled: false
+
+# -- GitHub token for renovate. If set, creates a secret `renovate-github-token`.
+# DO NOT SET IN HERE, THIS FILE IS NOT ENCRYPTED! USE values.yaml.secret
+github:
+  token: ""
diff --git a/renovate/files/chart/values.yaml.secret.example b/renovate/files/chart/values.yaml.secret.example
index 7276561b..d7007dfb 100644
--- a/renovate/files/chart/values.yaml.secret.example
+++ b/renovate/files/chart/values.yaml.secret.example
@@ -1,4 +1,4 @@
-renovate:
-  env:
-    # Used to pull the release changelog from GitHub
-    GITHUB_TOKEN: ""
+github:
+  # Used to pull the release changelog from GitHub.
+  # Stored in a Kubernetes Secret (renovate-github-token) and injected via secretKeyRef.
+  token: ""