diff --git a/.gitea/workflows/renovate.yaml b/.gitea/workflows/renovate.yaml
index 624eab6..56c1e73 100644
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -19,6 +19,9 @@ jobs:
           RENOVATE_ENDPOINT: https://git.neuf.no/api/v1
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_GIT_AUTHOR: Renovate <renovate@neuf.no>
+          # ed25519 key; its public half is on the renovate account. Gitea shows a commit as
+          # verified only if the author email is a verified email on that account.
+          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
           # Every edb repository the renovate account can write to
           RENOVATE_AUTODISCOVER: "true"
           RENOVATE_AUTODISCOVER_FILTER: edb/*
diff --git a/README.md b/README.md
index 1c418f9..08588ac 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,9 @@ has one. Each repository's `renovate.json` decides what is updated and when.
 
 - `RENOVATE_TOKEN`: a Gitea token with the scopes `write:repository`, `write:issue`,
   `read:user` and `read:organization`.
+- `RENOVATE_GIT_PRIVATE_KEY`: an ed25519 SSH key without a passphrase, which signs Renovate's commits. Its public key
+  is on the renovate account, which has `renovate@neuf.no` as a verified email. Merge with "Fast-forward only" to keep
+  the signed commit on the default branch.
 - `RENOVATE_GITHUB_COM_TOKEN`: a GitHub token with read-only access to public repositories. Without it Renovate hits
   GitHub's rate limit, skips GitHub Actions, pre-commit and mise lookups, and finds no release notes.