diff --git a/.github/workflows/auto-approve-bot-prs.yml b/.github/workflows/auto-approve-bot-prs.yml
index 33f17a5..24a6395 100644
--- a/.github/workflows/auto-approve-bot-prs.yml
+++ b/.github/workflows/auto-approve-bot-prs.yml
@@ -12,33 +12,15 @@ concurrency:
 
 jobs:
   approve:
-    if: github.ref == 'refs/heads/main' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != '' && vars.RENOVATE_GH_APP_CLIENT_ID != ''
+    if: github.ref == 'refs/heads/main' && vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID != ''
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       contents: read
       pull-requests: read
     steps:
-      - name: Create read-only token for the shared approval action
-        id: policy-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.RENOVATE_GH_APP_CLIENT_ID }}
-          private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: renovate-config
-          permission-contents: read
-      - name: Checkout the pinned shared approval action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: StackVista/renovate-config
-          ref: 45d01defd5070a9c05f0b3bf9b28995487bd8262
-          token: ${{ steps.policy-token.outputs.token }}
-          path: renovate-config
-          sparse-checkout: .github/actions/auto-approve-renovate
-          persist-credentials: false
       - name: Approve verified Renovate PRs
-        uses: ./renovate-config/.github/actions/auto-approve-renovate # zizmor: ignore[self-repository]
+        uses: StackVista/renovate-config/.github/actions/auto-approve-renovate@45d01defd5070a9c05f0b3bf9b28995487bd8262
         with:
           app-client-id: ${{ vars.RENOVATE_APPROVAL_GH_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.RENOVATE_APPROVAL_GH_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index bedbd55..d24b43c 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -29,9 +29,7 @@ jobs:
           client-id: ${{ vars.RENOVATE_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.RENOVATE_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          repositories: |
-            stackstate-backup-cli
-            renovate-config
+          repositories: stackstate-backup-cli
           permission-contents: write
           permission-pull-requests: write
           permission-issues: write
diff --git a/README.md b/README.md
index f482ae0..da41787 100644
--- a/README.md
+++ b/README.md
@@ -468,14 +468,13 @@ The library group includes direct and indirect modules.
 Other module minors, module majors, and Go release-line migrations require manual review.
 Dependency updates reach published binaries through the existing tag release process.
 
-This public repository runs Renovate locally because GitHub restricts private reusable workflows and actions to private callers.
-The approval workflow fetches the pinned shared action with a read-only updater App token.
+The approval workflow calls the pinned public `renovate-config` action directly.
 The separate approval App supplies the review token.
 The updater App needs Contents, Pull requests, Issues, and Workflows write permissions, plus Checks and Commit statuses read permissions.
 
 Before merging the Renovate workflows:
 
-1. Grant `renovate-update-app` access to this repository and `renovate-config`.
+1. Grant `renovate-update-app` access to this repository.
 2. Install `renovatee-approver-stackvista` on this repository.
 3. Apply the `pulumi-infra/github/repoVariables` changes that supply both Apps' credentials.
 4. Check that the live branch protection requires all five CI checks listed in `pulumi-infra/github/repositories/resources.yaml`.
diff --git a/renovate.json b/renovate.json
index ffd2080..62006ae 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,8 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>StackVista/renovate-config",
-    "local>StackVista/renovate-config:go"
+    "github>StackVista/renovate-config",
+    "github>StackVista/renovate-config:go"
   ],
   "prConcurrentLimit": 0,
   "prHourlyLimit": 0,