diff --git a/.github/workflows/renovate-config-validate.yml b/.github/workflows/renovate-config-validate.yml
new file mode 100644
index 0000000..2157007
--- /dev/null
+++ b/.github/workflows/renovate-config-validate.yml
@@ -0,0 +1,22 @@
+name: Validate
+
+on:
+  pull_request:
+    paths:
+      - 'default.json'
+      - '.renovaterc.json5'
+      - 'Makefile'
+      - '.github/workflows/renovate-config-validate.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5.0.0
+
+      - name: Run validation
+        run: make validate
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..ed9d56d
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,8 @@
+.PHONY: validate
+
+validate:
+	docker run --rm \
+		-v "$$(pwd):/work" \
+		-w /work \
+		ghcr.io/renovatebot/renovate:41 \
+		renovate-config-validator default.json .renovaterc.json5
diff --git a/default.json b/default.json
index 0a69bd3..dd8f0bc 100644
--- a/default.json
+++ b/default.json
@@ -3,6 +3,7 @@
     "extends": [
         "config:recommended",
         ":semanticCommits",
+        ":gitSignOff",
         ":rebaseStalePrs",
         ":configMigration",
         ":automergeDisabled",
@@ -18,7 +19,6 @@
     "constraints": {
         "go": "<1.26"
     },
-    "gitSignOff": true,
     "commitMessagePrefix": "build: ",
     "postUpdateOptions": [
         "gomodTidy",