diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 1843e06a..8634ac16 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -22,11 +22,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
+        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
 
       - name: Log into registry ${{ env.REGISTRY }}
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
@@ -37,7 +37,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
         with:
           images: ${{ env.REGISTRY }}/${{ github.repository }}
           tags: |
@@ -47,7 +47,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Setup buildx mount cache
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: |
             home-cache-386
@@ -93,7 +93,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
+        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
         with:
           context: .
           push: true
diff --git a/Dockerfile b/Dockerfile
index 300c57ff..d3d63e68 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
-FROM python:3.11-alpine@sha256:700b4aa84090748aafb348fc042b5970abb0a73c8f1b4fcfe0f4e3c2a4a9fcca
+FROM python:3.11.11-alpine@sha256:bc84eb94541f34a0e98535b130ea556ae85f6a431fdb3095762772eeb260ffc3
 
-# renovate: datasource=repology depName=alpine_3_20/gettext versioning=loose
+# renovate: datasource=repology depName=alpine_3_21/gettext versioning=loose
 ARG         GETTEXT_VERSION="0.22.5-r0"
 
 WORKDIR     /app
diff --git a/chart/Chart.lock b/chart/Chart.lock
index 7942c990..97ba9839 100644
--- a/chart/Chart.lock
+++ b/chart/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: common
   repository: https://bjw-s.github.io/helm-charts
-  version: 3.3.2
-digest: sha256:5a0f9f06aa383b7cc3070899b879401bcd4ae48b021d0a2b7f9ba39827019e24
-generated: "2024-08-18T12:14:16.193707111Z"
+  version: 3.6.0
+digest: sha256:e603cf43cb620fbff0032977816eae437bdfe971c2d7e92c298d1fe23e8a059c
+generated: "2024-12-26T10:38:15.76033522Z"
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index 7b5db7e6..6be86b54 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -12,7 +12,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://bjw-s.github.io/helm-charts
-    version: 3.3.2
+    version: 3.6.0
 sources:
   - https://github.com/jh0ker/mau_mau_bot
 annotations:
diff --git a/renovate.json b/renovate.json
index bc978c73..04e054c7 100644
--- a/renovate.json
+++ b/renovate.json
@@ -18,6 +18,17 @@
         "repology"
       ],
       "groupName": "OS Packages"
+    },
+    {
+      "description": "Separate python minor releases",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "python"
+      ],
+      "separateMultipleMinor": true,
+      "separateMinorPatch": true
     }
   ],
   "ignoreDeps": [
diff --git a/requirements.txt b/requirements.txt
index a583500a..1b2c707b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,2 @@
 python-telegram-bot==13.15
-pony==0.7.17
+pony==0.7.19