diff --git a/.github/actions/renovate/entrypoint.sh b/.github/actions/renovate/entrypoint.sh
new file mode 100755
index 0000000000000..09edef12cb8e3
--- /dev/null
+++ b/.github/actions/renovate/entrypoint.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+apt update
+
+apt install -y envsubst
+
+runuser -u ubuntu renovate
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index a138968ce82b8..16f23f313a482 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -39,6 +39,7 @@ jobs:
           # default to DEBUG log level, this is always useful
           LOG_LEVEL: ${{ github.event.inputs.renovate_log_level_debug == 'false' && 'INFO' || 'DEBUG' }}
         with:
+          docker-cmd-file: .github/actions/renovate/entrypoint.sh
           configurationFile: .github/renovate.json5
           token: '${{ steps.get_token.outputs.app_token }}'
           mount-docker-socket: true