diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 571c186..b51d0e6 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -206,31 +206,23 @@ jobs:
           echo "✓ Renovate location: $(which renovate)"
 
       - name: Configure Renovate for Gitea
-        env:
-          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
         run: |
           echo "=== Configuring Renovate for Gitea ==="
 
-          # Create Renovate configuration file
+          # Renovate reads RENOVATE_TOKEN, RENOVATE_PLATFORM, RENOVATE_ENDPOINT,
+          # and RENOVATE_GIT_AUTHOR directly from the environment at runtime.
+          # Keeping the config file minimal avoids repeated migration warnings.
           cat > renovate-config.js << 'EOF'
           module.exports = {
             platform: 'gitea',
             endpoint: 'https://dogar.darkhelm.org/api/v1',
-            token: process.env.RENOVATE_TOKEN,
             gitAuthor: 'Renovate Bot <renovate@darkhelm.org>',
             repositories: ['DarkHelm.org/plex-playlist'],
             onboarding: false,
             requireConfig: 'required',
-
-            // Use existing renovate.json configuration
             extends: ['local>DarkHelm.org/plex-playlist'],
-
-            // CI-specific settings
             prConcurrentLimit: 3,
             branchConcurrentLimit: 5,
-
-            // Dry run mode for testing
-            dryRun: process.env.RENOVATE_DRY_RUN === 'true'
           };
           EOF
 
@@ -238,6 +230,7 @@ jobs:
 
       - name: Run Renovate
         env:
+          # RENOVATE_TOKEN is the primary auth mechanism — set via repo secret.
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_DRY_RUN: ${{ inputs.dry_run }}
           RENOVATE_CONFIG_FILE: renovate-config.js