diff --git a/.github/renovate.json b/.github/renovate.json
index d601959f0..66bb74eb1 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -50,6 +50,18 @@
       "matchStrings": [
         "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) packageName=(?<packageName>\\S+)\\s+MATRIX_RENOVATE_VERSION: '(?<currentValue>[^']+)'"
       ]
+    },
+    {
+      "customType": "regex",
+      "description": "Update the ghcr.io/devture/ansible image referenced in the documentation. The devcontainer's Dockerfile is handled by the built-in dockerfile manager.",
+      "managerFilePatterns": [
+        "/^docs\\/ansible\\.md$/"
+      ],
+      "matchStrings": [
+        "ghcr\\.io\\/devture\\/ansible:(?<currentValue>[^\\s`]+)"
+      ],
+      "depNameTemplate": "ghcr.io/devture/ansible",
+      "datasourceTemplate": "docker"
     }
   ],
   "packageRules": [
@@ -66,6 +78,13 @@
       ],
       "allowedVersions": "/^v0\\./"
     },
+    {
+      "description": "ghcr.io/devture/ansible is tagged `<Alpine ansible package version>-<release>` (e.g. `14.0.0-r0-3`). Docker versioning would consider `-r0-3` a compatibility suffix and never offer `-r0-4`",
+      "matchDepNames": [
+        "ghcr.io/devture/ansible"
+      ],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-r(?<build>\\d+)-(?<revision>\\d+)$"
+    },
     {
       "description": "Housekeeping updates merge via branch push (no PR, no email); a failure on the branch still surfaces as a PR. i18n/requirements.txt bumps are exercised by the Matrix i18n workflow before merging.",
       "matchFileNames": [
diff --git a/bin/renovate-smoke-test.sh b/bin/renovate-smoke-test.sh
index 6fe4bbb64..815d97907 100755
--- a/bin/renovate-smoke-test.sh
+++ b/bin/renovate-smoke-test.sh
@@ -66,6 +66,11 @@ if ! jq --slurp --exit-status '
         and any(.packageFiles.regex[]?.deps[]?;
             .depName == "matrix-renovate-runner" and .datasource == "docker")
     )
+    and any(.[];
+        .msg == "Extracted dependencies"
+        and any(.packageFiles.regex[]?.deps[]?;
+            .depName == "ghcr.io/devture/ansible" and .datasource == "docker")
+    )
 ' "$log_file"; then
     echo 'Renovate did not complete dependency extraction successfully' >&2
     exit 1