diff --git a/.chezmoiexternal.toml b/.chezmoiexternal.toml
index 2484ec4..923e371 100644
--- a/.chezmoiexternal.toml
+++ b/.chezmoiexternal.toml
@@ -1,59 +1,59 @@
-# Paths are home-relative (e.g. .vim/...) so clones follow ~/.vim → sourceDir/vim.
+# Pinned archive externals (home-relative paths). Versions are in the URL so Renovate
+# and osv-scanner can track them. Use: chezmoi apply --refresh-externals
 # Vim: prefer vim-polyglot for syntax; keep vim-go (disable polyglot go); NERDTree = preservim fork.
 
 [".vim/pack/vendor/start/lightline.vim"]
-type = "git-repo"
-url = "https://github.com/itchyny/lightline.vim"
+type = "archive"
+url = "https://github.com/itchyny/lightline.vim/archive/d042c506cb2e7a59112a72447e0b5fe8739d9d1d.tar.gz"
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/lightline.vim".pull]
-args = ["--ff-only"]
 
 [".vim/pack/vendor/start/nerdtree"]
-type = "git-repo"
-url = "https://github.com/preservim/nerdtree.git"
+type = "archive"
+url = "https://github.com/preservim/nerdtree/archive/refs/tags/7.1.3.tar.gz"
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/nerdtree".pull]
-args = ["--ff-only"]
 
 [".vim/pack/vendor/start/vim-go"]
-type = "git-repo"
-url = "https://github.com/fatih/vim-go.git"
+type = "archive"
+url = "https://github.com/fatih/vim-go/archive/refs/tags/v1.29.tar.gz"
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/vim-go".pull]
-args = ["--ff-only"]
 
 [".vim/pack/vendor/start/vim-polyglot"]
-type = "git-repo"
-url = "https://github.com/sheerun/vim-polyglot.git"
+type = "archive"
+url = "https://github.com/sheerun/vim-polyglot/archive/refs/tags/v4.17.0.tar.gz"
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/vim-polyglot".pull]
-args = ["--ff-only"]
 
 [".vim/pack/vendor/start/material.vim"]
-type = "git-repo"
-url = "https://github.com/kaicataldo/material.vim.git"
+type = "archive"
+url = "https://github.com/kaicataldo/material.vim/archive/32f423c825ee89a37d66e3d8f00e777c7d8a41ab.tar.gz"
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/material.vim".pull]
-args = ["--ff-only"]
 
 [".vim/pack/vendor/start/incsearch.vim"]
-type = "git-repo"
-url = "https://github.com/haya14busa/incsearch.vim"
+type = "archive"
+url = "https://github.com/haya14busa/incsearch.vim/archive/refs/tags/v2.0.1.tar.gz"
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/incsearch.vim".pull]
-args = ["--ff-only"]
 
 # Zsh
 [".zsh/plugins/zsh-syntax-highlighting"]
-type = "git-repo"
-url = "https://github.com/zsh-users/zsh-syntax-highlighting.git"
+type = "archive"
+url = "https://github.com/zsh-users/zsh-syntax-highlighting/archive/refs/tags/0.8.0.tar.gz"
+stripComponents = 1
 refreshPeriod = "0"
-[".zsh/plugins/zsh-syntax-highlighting".pull]
-args = ["--ff-only"]
 
 [".zsh/plugins/zsh-completions"]
-type = "git-repo"
-url = "https://github.com/zsh-users/zsh-completions.git"
+type = "archive"
+url = "https://github.com/zsh-users/zsh-completions/archive/refs/tags/0.36.0.tar.gz"
+stripComponents = 1
+refreshPeriod = "0"
+
+# Shell
+[".shell/plugins/nord-dircolors"]
+type = "archive"
+url = "https://github.com/nordtheme/dircolors/archive/refs/tags/v0.2.0.tar.gz"
+stripComponents = 1
 refreshPeriod = "0"
-[".zsh/plugins/zsh-completions".pull]
-args = ["--ff-only"]
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000..942ba51
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,85 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":dependencyDashboard",
+    ":semanticCommits"
+  ],
+  "schedule": ["before 6am on monday"],
+  "labels": ["dependencies"],
+  "prConcurrentLimit": 5,
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Chezmoi archive externals pinned to git tags",
+      "managerFilePatterns": ["^\\.chezmoiexternal\\.toml$"],
+      "matchStrings": [
+        "url = \"https://github\\.com/(?<depName>[^/]+/[^/]+)/archive/refs/tags/(?<currentValue>[^\"]+)\\.tar\\.gz\""
+      ],
+      "datasourceTemplate": "github-tags",
+      "versioningTemplate": "semver"
+    },
+    {
+      "customType": "regex",
+      "description": "Chezmoi archive externals pinned to commit SHAs",
+      "managerFilePatterns": ["^\\.chezmoiexternal\\.toml$"],
+      "matchStrings": [
+        "url = \"https://github\\.com/(?<depName>[^/]+/[^/]+)/archive/(?<currentDigest>[a-f0-9]{40})\\.tar\\.gz\""
+      ],
+      "datasourceTemplate": "git-refs",
+      "currentValueTemplate": "HEAD",
+      "versioningTemplate": "git"
+    },
+    {
+      "customType": "regex",
+      "description": "Homebrew formulae in dot_Brewfile",
+      "managerFilePatterns": ["^dot_Brewfile$"],
+      "matchStrings": [
+        "^brew \"(?<depName>[a-z0-9][a-z0-9+@._/-]*)\"\\s*$"
+      ],
+      "datasourceTemplate": "repology",
+      "lookupNameTemplate": "homebrew/{{{depName}}}",
+      "versioningTemplate": "loose"
+    },
+    {
+      "customType": "regex",
+      "description": "Homebrew casks in dot_Brewfile",
+      "managerFilePatterns": ["^dot_Brewfile$"],
+      "matchStrings": [
+        "^cask \"(?<depName>[a-z0-9][a-z0-9+@._/-]*)\"\\s*$"
+      ],
+      "datasourceTemplate": "repology",
+      "lookupNameTemplate": "homebrew_casks/{{{depName}}}",
+      "versioningTemplate": "loose"
+    },
+    {
+      "customType": "regex",
+      "description": "Go tools installed via brew bundle go directive",
+      "managerFilePatterns": ["^dot_Brewfile$"],
+      "matchStrings": [
+        "^go \"(?<depName>[^\"]+)\"\\s*$"
+      ],
+      "datasourceTemplate": "go",
+      "versioningTemplate": "go"
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "Group chezmoi external bumps",
+      "matchManagers": ["custom.regex"],
+      "matchFileNames": [".chezmoiexternal.toml"],
+      "groupName": "chezmoi externals"
+    },
+    {
+      "description": "Group Homebrew bundle updates",
+      "matchManagers": ["custom.regex"],
+      "matchFileNames": ["dot_Brewfile"],
+      "groupName": "homebrew bundle"
+    },
+    {
+      "description": "Group GitHub Actions",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
+    }
+  ]
+}
diff --git a/.github/workflows/chezmoi.yml b/.github/workflows/chezmoi.yml
new file mode 100644
index 0000000..cd5467b
--- /dev/null
+++ b/.github/workflows/chezmoi.yml
@@ -0,0 +1,47 @@
+name: chezmoi
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  CHEZMOI_VERSION: v2.71.0
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install chezmoi
+        run: |
+          sh -c "$(curl -fsLS get.chezmoi.io)" -- -b "$HOME/.local/bin" "$CHEZMOI_VERSION"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Write test chezmoi config
+        run: |
+          mkdir -p "$HOME/.config/chezmoi"
+          cat > "$HOME/.config/chezmoi/chezmoi.toml" <<EOF
+          mode = "symlink"
+          sourceDir = "${{ github.workspace }}"
+          [data]
+          git_name = "CI User"
+          git_email = "ci@example.com"
+          github_user = "cibot"
+          machine_name = "ci"
+          EOF
+
+      - name: Render templates
+        run: |
+          set -euo pipefail
+          while IFS= read -r -d '' f; do
+            echo "Rendering ${f#./}"
+            chezmoi execute-template --init \
+              -c "$HOME/.config/chezmoi/chezmoi.toml" \
+              < "$f" > /dev/null
+          done < <(find . -name '*.tmpl' -not -path './.git/*' -print0)
+
+      - name: Dry-run apply
+        run: chezmoi apply --dry-run --verbose --refresh-externals=never
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
new file mode 100644
index 0000000..3b1e5fb
--- /dev/null
+++ b/.github/workflows/dependency-audit.yml
@@ -0,0 +1,73 @@
+name: dependency-audit
+
+on:
+  schedule:
+    - cron: '0 8 * * 1'
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .chezmoiexternal.toml
+      - dot_Brewfile
+      - .github/workflows/dependency-audit.yml
+
+jobs:
+  osv-scan-externals:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install osv-scanner
+        run: |
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.3.1
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
+      - name: Download pinned chezmoi externals
+        run: |
+          set -euo pipefail
+          mkdir -p /tmp/dotfiles-externals
+          grep -E '^url = ' .chezmoiexternal.toml | sed 's/^url = "//;s/"$//' | while read -r url; do
+            name=$(basename "$url" .tar.gz | sed 's/-[a-f0-9]\{40\}$//')
+            echo "Fetching $name"
+            curl -fsSL "$url" -o "/tmp/$name.tar.gz"
+            mkdir -p "/tmp/dotfiles-externals/$name"
+            tar -xzf "/tmp/$name.tar.gz" -C "/tmp/dotfiles-externals/$name" --strip-components=1
+          done
+
+      - name: Scan externals with OSV
+        run: osv-scanner scan source --recursive /tmp/dotfiles-externals
+
+  brew-outdated-report:
+    runs-on: macos-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Report outdated Homebrew packages from dot_Brewfile
+        run: |
+          set -uo pipefail
+          brew update
+          {
+            echo "## Homebrew packages referenced in dot_Brewfile"
+            echo '```'
+            while read -r line; do
+              case "$line" in
+                brew\ \"*\"|cask\ \"*\")
+                  pkg=$(echo "$line" | sed -E 's/^(brew|cask) "([^"]+)".*/\2/')
+                  kind=$(echo "$line" | sed -E 's/^(brew|cask).*/\1/')
+                  if [ "$kind" = cask ]; then
+                    outdated=$(brew outdated --cask --quiet "$pkg" 2>/dev/null || true)
+                  else
+                    outdated=$(brew outdated --formula --quiet "$pkg" 2>/dev/null || true)
+                  fi
+                  if [ -n "$outdated" ]; then
+                    echo "OUTDATED $kind $pkg"
+                  else
+                    echo "current  $kind $pkg"
+                  fi
+                  ;;
+              esac
+            done < dot_Brewfile
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/README.md b/README.md
index e895c35..1be26bb 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 **Shell:** **Fish** is the intended daily driver (`~/.config/fish/` from **`dot_config/fish/`**). **Zsh** remains available (`dot_zshrc.tmpl`, `~/.zsh` symlink) for compatibility or scripts.
 
-Large trees (`vim/`, `zsh/`, `shell/` under the source dir) are populated by **`git-repo` externals** in [`.chezmoiexternal.toml`](.chezmoiexternal.toml). External paths are **home-relative** (`.vim/…`, `.zsh/…`, `.shell/…`) so clones land behind the `~/.vim`, `~/.zsh`, and `~/.shell` symlinks into this repo.
+Large trees (`vim/`, `zsh/`, `shell/` under the source dir) are populated by **pinned `archive` externals** in [`.chezmoiexternal.toml`](.chezmoiexternal.toml). External paths are **home-relative** (`.vim/…`, `.zsh/…`, `.shell/…`) so archives land behind the `~/.vim`, `~/.zsh`, and `~/.shell` symlinks into this repo. Versions are pinned in each archive URL; [Renovate](.github/renovate.json) opens PRs to bump them.
 
 ## First-time setup
 
@@ -35,10 +35,26 @@ chezmoi apply --refresh-externals
 
 Or your usual **`dfu`** alias if it wraps the same steps.
 
+## Dependency monitoring
+
+1. **Enable [Renovate](https://github.com/apps/renovate)** on this repository (uses [`.github/renovate.json`](.github/renovate.json)).
+   - Bumps pinned chezmoi **archive** URLs in `.chezmoiexternal.toml` (tags and commit SHAs).
+   - Bumps `brew` / `cask` / `go` lines in `dot_Brewfile` via Repology and the Go module index.
+   - Bumps **GitHub Actions** in workflows.
+2. **CI** ([`.github/workflows/dependency-audit.yml`](.github/workflows/dependency-audit.yml)) runs weekly:
+   - Downloads pinned externals and scans them with [OSV-Scanner](https://github.com/google/osv-scanner).
+   - On macOS, reports outdated Homebrew formulae/casks from `dot_Brewfile` in the job summary.
+3. **Locally** after `chezmoi apply --refresh-externals`, inspect checked-out SHAs:
+   ```bash
+   for d in ~/.vim/pack/vendor/start/* ~/.zsh/plugins/* ~/.shell/plugins/*; do
+     [ -d "$d" ] && echo "$d"
+   done
+   ```
+
 ## Layout notes
 
 - **Fish** (`dot_config/fish/`): `conf.d/` snippets (PATH from **`00-chezmoi-path.fish.tmpl`**, env, abbreviations, dircolors, Catppuccin theme, vi bindings, secrets) and **`functions/`** for `dfu`, `load_secret`, `cdgr`, `up`, helpers, plus **`fish_prompt`** / **`fish_right_prompt`** (cwd + `USER at <~/.name>` + `fish_git_prompt`). Not ported from zsh: async right-prompt, `tog` / `vshow` / `vmultiline`.
-- **Vim externals** ([`.chezmoiexternal.toml`](.chezmoiexternal.toml)): [vim-polyglot](https://github.com/sheerun/vim-polyglot) for bundled syntax; [vim-go](https://github.com/fatih/vim-go) with **`g:polyglot_disabled = ['go']`** in `dot_vimrc` so Go stays on vim-go. Separate trees for [preservim/nerdtree](https://github.com/preservim/nerdtree), [lightline.vim](https://github.com/itchyny/lightline.vim), [material.vim](https://github.com/kaicataldo/material.vim), [incsearch.vim](https://github.com/haya14busa/incsearch.vim). Dircolors: [nordtheme/dircolors](https://github.com/nordtheme/dircolors) under `~/.shell/plugins/nord-dircolors/`.
+- **Vim / Zsh / shell externals** ([`.chezmoiexternal.toml`](.chezmoiexternal.toml)): pinned GitHub **archive** downloads for [vim-polyglot](https://github.com/sheerun/vim-polyglot), [vim-go](https://github.com/fatih/vim-go) (`g:polyglot_disabled = ['go']` in `dot_vimrc`), [preservim/nerdtree](https://github.com/preservim/nerdtree), [lightline.vim](https://github.com/itchyny/lightline.vim), [material.vim](https://github.com/kaicataldo/material.vim), [incsearch.vim](https://github.com/haya14busa/incsearch.vim), zsh plugins, and [nordtheme/dircolors](https://github.com/nordtheme/dircolors) under `~/.shell/plugins/nord-dircolors/`.
 - **`dot_zshrc.tmpl`**: main zsh init (PATH, Homebrew on macOS, shared `~/.shell` and `~/.zsh` bits). Optional **`~/.zshrc.local`** is sourced last for machine-only overrides (not in this repo).
 - **`dot_hammerspoon/`** is skipped on non-macOS via **`.chezmoiignore.tmpl`**.
 - **`dotfiles-local/`** is ignored until removed locally.