diff --git a/.github/workflows/lint-web.yml b/.github/workflows/lint-web.yml
index a71cd7d3..b9cd32e9 100644
--- a/.github/workflows/lint-web.yml
+++ b/.github/workflows/lint-web.yml
@@ -37,9 +37,9 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
         with:
+          package_json_file: web/package.json
           cache: true
           run_install: false
-          version: 11
 
       - name: Install deps
         working-directory: web
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d0e6b967..687a5763 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -94,9 +94,9 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
+          package_json_file: web/package.json
           cache: true
           run_install: false
-          version: 11
 
       - name: Build frontend
         working-directory: web
@@ -353,16 +353,14 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
         with:
+          package_json_file: web/package.json
           cache: true
           run_install: false
-          version: 11
 
-      # Change to '--frozen-lockfile' once this gets fixed:
-      # https://github.com/pnpm/action-setup/issues/40
       - name: Build frontend
         working-directory: web
         run: |
-          pnpm install --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --frozen-lockfile
           pnpm build
 
       - name: Install Rust stable
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index ba363f0c..8697da6a 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -1,10 +1 @@
 vulnerabilities:
-  - id: GHSA-w5hq-g745-h8pq
-    expired_at: 2026-05-23
-    statement: "Waiting for upstream patch in paraglide"
-  - id: CVE-2026-29111
-    expired_at: 2026-05-31
-    statement: "No fixed version available in debian:13-slim - waiting for Debian to backport systemd patch"
-  - id: CVE-2025-69720
-    expired_at: 2026-05-31
-    statement: "No fixed version available in debian:13-slim - waiting for Debian to release ncurses patch"
diff --git a/package.json b/package.json
index 18c8c1d5..bc46481f 100644
--- a/package.json
+++ b/package.json
@@ -1,4 +1,5 @@
 {
+	"packageManager": "pnpm@11.9.0",
 	"devDependencies": {
 		"@tanstack/devtools-vite": "^0.3.12"
 	}
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..0f3a2535
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>DefGuard/ci-workflows//renovate/default.json"]
+}
diff --git a/web/package.json b/web/package.json
index 861df7ea..5ec3d290 100644
--- a/web/package.json
+++ b/web/package.json
@@ -2,6 +2,7 @@
   "name": "web",
   "private": true,
   "version": "2.0.2",
+  "packageManager": "pnpm@11.9.0",
   "type": "module",
   "scripts": {
     "dev": "vite",