diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 9cd5a56a..8dc408bb 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -10,11 +10,16 @@ FROM python:${PYTHON_VERSION} as dev
 # ARG is used here for temporary override without changing the original env.
 ARG PYTHON_VERSION
 
+# renovate: depName=debian_12/pipx
+ARG PIPX_VERSION="1.1.0-1"
+# renovate: depName=debian_12/sudo
+ARG SUDO_VERSION="1.9.13p3-1+deb12u1"
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
 #   pipx: To install Python applications.
-    pipx \
+    pipx="${PIPX_VERSION}" \
 #   sudo: To add sudo support to non-root user.
-    sudo \
+    sudo="${SUDO_VERSION}" \
     && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 # Config pipx
diff --git a/.renovaterc.json b/.renovaterc.json
index 9adb4e88..c2411867 100644
--- a/.renovaterc.json
+++ b/.renovaterc.json
@@ -12,6 +12,19 @@
                 "pipx install (?<depName>.*?)==(?<currentValue>.*?)[;\n]"
             ]
         },
+        {
+            "customType": "regex",
+            "datasourceTemplate": "repology",
+            "depTypeTemplate": "apt",
+            "fileMatch": [
+                "^\\.devcontainer\\/Dockerfile$",
+                "^template\\/\\.devcontainer/Dockerfile\\.jinja$"
+            ],
+            "matchStrings": [
+                "# renovate: depName=(?<depName>.*?)\nARG .*?_VERSION=\"(?<currentValue>.*)\"\n"
+            ],
+            "versioningTemplate": "deb"
+        },
         {
             "customType": "regex",
             "datasourceTemplate": "git-tags",
@@ -93,6 +106,13 @@
             },
             "semanticCommitScope": "copier-template"
         },
+        {
+            "description": "Group apt packages to avoid failure when multiple packages are outdated.",
+            "groupName": "apt packages",
+            "matchDepTypes": [
+                "apt"
+            ]
+        },
         {
             "description": "Pre-commit 3.5.0 is pinned as the last version supporting Python 3.8.",
             "enabled": false,
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 16c6aa9c..cd625805 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -48,6 +48,7 @@
     "pytest",
     "Quickstart",
     "renovatebot",
+    "repology",
     "setuptools",
     "softprops",
     "sphinxcontrib",
diff --git a/template/.devcontainer/Dockerfile.jinja b/template/.devcontainer/Dockerfile.jinja
index 16a3be4b..1100b1cb 100644
--- a/template/.devcontainer/Dockerfile.jinja
+++ b/template/.devcontainer/Dockerfile.jinja
@@ -10,11 +10,16 @@ FROM python:${PYTHON_VERSION} as dev
 # ARG is used here for temporary override without changing the original env.
 ARG PYTHON_VERSION
 
+# renovate: depName=debian_12/pipx
+ARG PIPX_VERSION="1.1.0-1"
+# renovate: depName=debian_12/sudo
+ARG SUDO_VERSION="1.9.13p3-1+deb12u1"
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
 #   pipx: To install Python applications.
-    pipx \
+    pipx="${PIPX_VERSION}" \
 #   sudo: To add sudo support to non-root user.
-    sudo \
+    sudo="${SUDO_VERSION}" \
     && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 # Config pipx
diff --git a/template/.renovaterc.json.jinja b/template/.renovaterc.json.jinja
index 8222d227..248ee80a 100644
--- a/template/.renovaterc.json.jinja
+++ b/template/.renovaterc.json.jinja
@@ -15,6 +15,21 @@
                 "pipx install (?<depName>.*?)==(?<currentValue>.*?)[;\n]"
             ]
         },
+        {
+            "customType": "regex",
+            "datasourceTemplate": "repology",
+            "depTypeTemplate": "apt",
+            "fileMatch": [
+                "^\\.devcontainer\\/Dockerfile$"
+[%- if project_name == "Serious Scaffold Python" %],
+                "^template\\/\\.devcontainer/Dockerfile\\.jinja$"
+[%- endif %]
+            ],
+            "matchStrings": [
+                "# renovate: depName=(?<depName>.*?)\nARG .*?_VERSION=\"(?<currentValue>.*)\"\n"
+            ],
+            "versioningTemplate": "deb"
+        },
         {
             "customType": "regex",
             "datasourceTemplate": "git-tags",
@@ -100,6 +115,13 @@
             },
             "semanticCommitScope": "copier-template"
         },
+        {
+            "description": "Group apt packages to avoid failure when multiple packages are outdated.",
+            "groupName": "apt packages",
+            "matchDepTypes": [
+                "apt"
+            ]
+        },
         {
             "description": "Pre-commit 3.5.0 is pinned as the last version supporting Python 3.8.",
             "enabled": false,
diff --git a/template/.vscode/settings.json b/template/.vscode/settings.json
index 16c6aa9c..cd625805 100644
--- a/template/.vscode/settings.json
+++ b/template/.vscode/settings.json
@@ -48,6 +48,7 @@
     "pytest",
     "Quickstart",
     "renovatebot",
+    "repology",
     "setuptools",
     "softprops",
     "sphinxcontrib",