diff --git a/README.md b/README.md
index beee113..8e32fc6 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,22 @@ Instalar con:
 cp .githooks/pre-commit .git/hooks/pre-commit
 chmod +x .git/hooks/pre-commit
 ```
+## Renovate Bot
+
+Secret `renovate-token` gestionado manualmente (no está en el repo).
+Para recrearlo:
+
+```bash
+kubectl create secret generic renovate-token \
+  --from-literal=RENOVATE_TOKEN=<token-gitea> \
+  -n renovate
+```
+
+Token en https://git.chemavx.xyz/user/settings/applications con permisos:
+`issue`: Read/Write, `repository`: Read/Write, `user`: Read
+
+Imagen fijada a `38.0.0` — no actualizar a `latest` sin probar autenticación primero.
+
 ## ArgoCD patches
 Después de instalar ArgoCD aplicar:
 `kubectl apply -f argocd-patches/redis-patch.yaml`
diff --git a/renovate/cronjob-renovate.yaml b/renovate/cronjob-renovate.yaml
index 223db16..9bb7cac 100644
--- a/renovate/cronjob-renovate.yaml
+++ b/renovate/cronjob-renovate.yaml
@@ -27,7 +27,7 @@ spec:
             - name: RENOVATE_CONFIG_FILE
               value: /opt/renovate/config.js
             - name: LOG_LEVEL
-              value: debug
+              value: info
             resources:
               requests:
                 cpu: 100m