diff --git a/.forgejo/actions/renovate/action.yaml b/.forgejo/actions/renovate/action.yaml
deleted file mode 100644
index fbcf606..0000000
--- a/.forgejo/actions/renovate/action.yaml
+++ /dev/null
@@ -1,64 +0,0 @@
-# action.yml
-name: renovate
-description: 'renovate with caching'
-
-inputs:
-  endpoint:
-    description: 'Renovate Endpoint'
-    required: true
-  token:
-    description: 'Renovate Token'
-    required: true
-  github-token:
-    description: 'GitHub Token'
-    required: true
-  github-username:
-    description: 'GitHub Username'
-    required: true
-  docker-username:
-    description: 'Docker Hub Username'
-    required: true
-  docker-password:
-    description: 'Docker Hub Password'
-    required: true
-  args:
-    description: 'Renovate Args'
-    required: false
-    default: ''
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Cache Renovate
-      uses: https://code.forgejo.org/actions/cache@v4.2.0
-      with:
-        path: |
-          .tmp/cache/renovate/repository
-        key: renovate-${{ inputs.endpoint }}-${{ github.run_id }}
-        restore-keys: |
-          renovate-${{ inputs.endpoint }}-
-        compression: true
-        timeout: 900000
-        retry: 5
-        retry-wait: 5000
-
-    - run: |
-        renovate ${{ inputs.args }}
-      shell: bash
-      env:
-        GITHUB_COM_TOKEN: ${{ inputs.github-token }}
-        LOG_LEVEL: debug
-        RENOVATE_BASE_DIR: ${{ github.workspace }}/.tmp
-        RENOVATE_ENDPOINT: ${{ github.server_url }}
-        RENOVATE_GIT_AUTHOR: 'Renovate Bot <smeagol@hsn.dev>'
-        RENOVATE_PLATFORM: gitea
-        RENOVATE_REPOSITORY_CACHE: 'disabled'
-        RENOVATE_TOKEN: ${{ inputs.token }}
-        RENOVATE_HOST_RULES: |-
-          [
-            {"matchHost":"docker.io","hostType":"docker","username":"${{ inputs.docker-username }}","password":"${{ inputs.docker-password }}"},
-          ]
-        GIT_AUTHOR_NAME: 'Renovate Bot'
-        GIT_AUTHOR_EMAIL: 'smeagol@hsn.dev'
-        GIT_COMMITTER_NAME: 'Renovate Bot'
-        GIT_COMMITTER_EMAIL: 'smeagol@hsn.dev'
diff --git a/.forgejo/workflows/renovate.yaml b/.forgejo/workflows/renovate.yaml
index 4cb7543..6a4d4f8 100644
--- a/.forgejo/workflows/renovate.yaml
+++ b/.forgejo/workflows/renovate.yaml
@@ -2,17 +2,16 @@ on:
   schedule:
     - cron: '*/30 * * * *'
   push:
-    branches: ["main"]
-    paths: [".forgejo/workflows/renovate.yaml"]
   workflow_dispatch:
     inputs:
-      dryRun:
-        default: false
-        description: Dry Run
+      args:
+        description: 'Optional renovate args, they replace the defaults and disable autodiscover'
         required: false
-        type: boolean
+        type: string
+
 env:
-  RENOVATE_DRY_RUN: "${{ inputs.dryRun == true }}"
+  RENOVATE_DRY_RUN: ${{ ((github.event_name != 'schedule' && github.event_name != 'workflow_dispatch') || github.ref_name != 'main') && 'full' || '' }}
+  RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.GPG }}
 
 jobs:
   renovate:
@@ -20,17 +19,64 @@ jobs:
     runs-on: docker-x86_64
     container:
       image: git.hsn.dev/jahanson/renovate/renovate:39.87.0@sha256:3a17d23d6fb3ca2169b079bf2c970cb25567be639ba42bb2064750973b69b83c
+      options: --tmpfs /tmp:exec
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           show-progress: false
-      - name: Renovate
-        uses: ./.forgejo/actions/renovate
+
+      - name: Restore renovate repo cache
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
-          endpoint: https://git.hsn.dev/api/v1/
-          token: ${{ secrets.RUNAS_USER_TOKEN }}
-          args: --platform gitea --autodiscover
-          github-token: ${{ secrets.GH_TOKEN }}
-          docker-username: ${{ secrets.DOCKER_USERNAME }}
-          docker-password: ${{ secrets.DOCKER_PASSWORD }}
+          path: |
+            /tmp/renovate/cache/renovate/repository
+          key: repo-cache-${{ github.run_id }}
+          restore-keys: |
+            repo-cache-
+      - name: Restore renovate package cache
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        with:
+          path: |
+            /tmp/renovate/cache/renovate/renovate-cache-sqlite
+          key: package-cache-${{ github.run_id }}
+          restore-keys: |
+            package-cache-
+
+      - name: Renovate
+        run: |
+          renovate ${{ env.INPUT_ARGS }}
+        env:
+          GITHUB_COM_TOKEN: ${{ inputs.github-token }}
+          LOG_LEVEL: debug
+          RENOVATE_ENDPOINT: ${{ github.server_url }}
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_REPOSITORY_CACHE: 'enabled'
+          RENOVATE_TOKEN: ${{ github.repository == 'jahanson/renovate-config' && secrets.TOKEN || secrets.GITHUB_TOKEN }}
+          RENOVATE_GIT_AUTHOR: 'Renovate Bot <smeagol@hsn.dev>'
+          # RENOVATE_HOST_RULES: |-
+          #   [
+          #     {"matchHost":"docker.io","hostType":"docker","username":"${{ inputs.docker-username }}","password":"${{ inputs.docker-password }}"},
+          #   ]
+          RENOVATE_X_SQLITE_PACKAGE_CACHE: true
+          GIT_AUTHOR_NAME: 'Renovate Bot'
+          GIT_AUTHOR_EMAIL: 'smeagol@hsn.dev'
+          GIT_COMMITTER_NAME: 'Renovate Bot'
+          GIT_COMMITTER_EMAIL: 'smeagol@hsn.dev'
+          INPUT_ARGS: ${{ inputs.args || (github.repository != 'jahanson/renovate-config' && github.repository) || '--autodiscover' }}
+
+      - name: Save renovate repo cache
+        if: always() && env.RENOVATE_DRY_RUN != 'full'
+        uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        with:
+          path: |
+            /tmp/renovate/cache/renovate/repository
+          key: repo-cache-${{ inputs.endpoint }}-${{ github.run_id }}
+
+      - name: Save renovate package cache
+        if: always() && env.RENOVATE_DRY_RUN != 'full'
+        uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        with:
+          path: |
+            /tmp/renovate/cache/renovate/renovate-cache-sqlite
+          key: package-cache-${{ github.run_id }}