diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 89a429c3..8c4ffcd6 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,5 +1,5 @@
 # Refer to https://hub.docker.com/_/microsoft-dotnet-sdk for available versions
-FROM mcr.microsoft.com/dotnet/sdk:9.0.100-noble
+FROM mcr.microsoft.com/dotnet/sdk:9.0.101-noble
 
 # Installing mono makes `dotnet test` work without errors even for net472.
 # But installing it takes a long time, so it's excluded by default.
diff --git a/.github/actions/publish-artifacts/action.yaml b/.github/actions/publish-artifacts/action.yaml
index 94b74261..228b6404 100644
--- a/.github/actions/publish-artifacts/action.yaml
+++ b/.github/actions/publish-artifacts/action.yaml
@@ -5,7 +5,7 @@ runs:
   using: composite
   steps:
   - name: 📥 Collect artifacts
-    run: azure-pipelines/artifacts/_stage_all.ps1
+    run: tools/artifacts/_stage_all.ps1
     shell: pwsh
     if: always()
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index cba54c3a..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Please see the documentation for all configuration options:
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
-version: 2
-updates:
-- package-ecosystem: npm
-  directory: /src/nerdbank-streams
-  schedule:
-    interval: monthly
-- package-ecosystem: nuget
-  directory: /
-  schedule:
-    interval: weekly
-  ignore:
-  - dependency-name: Microsoft.Bcl.AsyncInterfaces # We want to match the minimum target .NET runtime
-- package-ecosystem: dotnet-sdk
-  directory: /
-  schedule:
-    interval: monthly
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 00000000..53deb468
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,31 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": ["config:recommended"],
+	"semanticCommits": "disabled",
+	"prHourlyLimit": 5,
+	"labels": ["dependencies"],
+	"packageRules": [
+		{
+			"matchPackageNames": ["nbgv", "nerdbank.gitversioning"],
+			"groupName": "nbgv and nerdbank.gitversioning updates"
+		},
+		{
+			"matchPackageNames": ["xunit*"],
+			"groupName": "xunit"
+		},
+		{
+			"matchDatasources": ["dotnet-version", "docker"],
+			"matchDepNames": ["dotnet-sdk", "mcr.microsoft.com/dotnet/sdk"],
+			"groupName": "Dockerfile and global.json updates"
+		},
+		{
+			"matchPackageNames": [
+				"Microsoft.Bcl.AsyncInterfaces",
+				"System.Collections.Immutable",
+				"System.Text.Json"
+			],
+			"allowedVersions": "<9.0",
+			"groupName": "Included in .NET runtime"
+		}
+	]
+}
diff --git a/.github/workflows/libtemplate-update.yml b/.github/workflows/libtemplate-update.yml
index f78c7e08..c6b8fb4a 100644
--- a/.github/workflows/libtemplate-update.yml
+++ b/.github/workflows/libtemplate-update.yml
@@ -25,7 +25,7 @@ jobs:
       id: merge
       shell: pwsh
       run: |
-        $LibTemplateBranch = & ./azure-pipelines/Get-LibTemplateBasis.ps1 -ErrorIfNotRelated
+        $LibTemplateBranch = & ./tools/Get-LibTemplateBasis.ps1 -ErrorIfNotRelated
         if ($LASTEXITCODE -ne 0) {
           exit $LASTEXITCODE
         }
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3d4516aa..783ba231 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -68,3 +68,13 @@ You can make changes and host the site locally to preview them by switching to t
 After making a change, you can rebuild the docs site while the localhost server is running by running `dotnet docfx` again from a separate terminal.
 
 The `.github/workflows/docs.yml` GitHub Actions workflow publishes the content of these docs to github.io if the workflow itself and [GitHub Pages is enabled for your repository](https://docs.github.com/en/pages/quickstart).
+
+## Updating dependencies
+
+This repo uses Renovate to keep dependencies current.
+Configuration is in the `.github/renovate.json` file.
+[Learn more about configuring Renovate](https://docs.renovatebot.com/configuration-options/).
+
+When changing the renovate.json file, follow [these validation steps](https://docs.renovatebot.com/config-validation/).
+
+If Renovate is not creating pull requests when you expect it to, check that the [Renovate GitHub App](https://github.com/apps/renovate) is configured for your account or repo.
diff --git a/azure-pipelines/collect-artifacts.yml b/azure-pipelines/collect-artifacts.yml
index c209db33..ffb4a5ce 100644
--- a/azure-pipelines/collect-artifacts.yml
+++ b/azure-pipelines/collect-artifacts.yml
@@ -2,7 +2,7 @@ parameters:
   SignArtifacts:
 
 steps:
-- powershell: azure-pipelines/variables/_pipelines.ps1
+- powershell: tools/variables/_define.ps1
   failOnStderr: true
   displayName: ⚙ Update pipeline variables based on build outputs
   condition: succeededOrFailed()
@@ -28,16 +28,16 @@ steps:
     displayName: 🔏 Code sign
     condition: and(succeeded(), eq(variables['System.TeamFoundationCollectionUri'], 'https://dev.azure.com/andrewarnott/'), ne(variables['Build.Reason'], 'PullRequest'))
 
-- powershell: azure-pipelines/artifacts/_pipelines.ps1 -ArtifactNameSuffix "-$(Agent.JobName)" -Verbose
+- powershell: azure-pipelines/publish_artifacts.ps1 -ArtifactNameSuffix "-$(Agent.JobName)" -Verbose
   failOnStderr: true
   displayName: 📢 Publish artifacts
   condition: succeededOrFailed()
 
 - ${{ if and(ne(variables['codecov_token'], ''), parameters.RunTests) }}:
   - powershell: |
-      $ArtifactStagingFolder = & "azure-pipelines/Get-ArtifactsStagingDirectory.ps1"
+      $ArtifactStagingFolder = & "tools/Get-ArtifactsStagingDirectory.ps1"
       $CoverageResultsFolder = Join-Path $ArtifactStagingFolder "coverageResults-$(Agent.JobName)"
-      azure-pipelines/publish-CodeCov.ps1 -CodeCovToken "$(codecov_token)" -PathToCodeCoverage "$CoverageResultsFolder" -Name "$(Agent.JobName) Coverage Results" -Flags "$(Agent.JobName)"
+      tools/publish-CodeCov.ps1 -CodeCovToken "$(codecov_token)" -PathToCodeCoverage "$CoverageResultsFolder" -Name "$(Agent.JobName) Coverage Results" -Flags "$(Agent.JobName)"
     displayName: 📢 Publish code coverage results to codecov.io
     timeoutInMinutes: 3
     continueOnError: true
diff --git a/azure-pipelines/dotnet.yml b/azure-pipelines/dotnet.yml
index 83188363..fb20ce4a 100644
--- a/azure-pipelines/dotnet.yml
+++ b/azure-pipelines/dotnet.yml
@@ -9,7 +9,7 @@ steps:
 - script: dotnet build -t:build,pack --no-restore -c $(BuildConfiguration) -warnAsError -warnNotAsError:NU1901,NU1902,NU1903,NU1904 /bl:"$(Build.ArtifactStagingDirectory)/build_logs/build.binlog"
   displayName: 🛠 dotnet build
 
-- powershell: azure-pipelines/dotnet-test-cloud.ps1 -Configuration $(BuildConfiguration) -Agent $(Agent.JobName) -PublishResults
+- powershell: tools/dotnet-test-cloud.ps1 -Configuration $(BuildConfiguration) -Agent $(Agent.JobName) -PublishResults
   displayName: 🧪 dotnet test
   condition: and(succeeded(), ${{ parameters.RunTests }})
 
diff --git a/azure-pipelines/install-dependencies.yml b/azure-pipelines/install-dependencies.yml
index 81782668..5944bc9e 100644
--- a/azure-pipelines/install-dependencies.yml
+++ b/azure-pipelines/install-dependencies.yml
@@ -19,7 +19,7 @@ steps:
     }
   displayName: ⚙ Install prerequisites
 
-- powershell: azure-pipelines/variables/_pipelines.ps1
+- powershell: tools/variables/_define.ps1
   failOnStderr: true
   displayName: ⚙ Set pipeline variables based on source
   name: SetPipelineVariables
diff --git a/azure-pipelines/justnugetorg.nuget.config b/azure-pipelines/justnugetorg.nuget.config
deleted file mode 100644
index 765346e5..00000000
--- a/azure-pipelines/justnugetorg.nuget.config
+++ /dev/null
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<configuration>
-  <packageSources>
-    <clear />
-    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
-  </packageSources>
-</configuration>
diff --git a/azure-pipelines/libtemplate-update.yml b/azure-pipelines/libtemplate-update.yml
index 87302b06..fdfa1df5 100644
--- a/azure-pipelines/libtemplate-update.yml
+++ b/azure-pipelines/libtemplate-update.yml
@@ -28,7 +28,7 @@ stages:
       fetchDepth: 0
       clean: true
     - pwsh: |
-        $LibTemplateBranch = & ./azure-pipelines/Get-LibTemplateBasis.ps1 -ErrorIfNotRelated
+        $LibTemplateBranch = & ./tools/Get-LibTemplateBasis.ps1 -ErrorIfNotRelated
         if ($LASTEXITCODE -ne 0) {
           exit $LASTEXITCODE
         }
diff --git a/azure-pipelines/artifacts/_pipelines.ps1 b/azure-pipelines/publish_artifacts.ps1
similarity index 92%
rename from azure-pipelines/artifacts/_pipelines.ps1
rename to azure-pipelines/publish_artifacts.ps1
index 5f259a51..3f35cc6e 100644
--- a/azure-pipelines/artifacts/_pipelines.ps1
+++ b/azure-pipelines/publish_artifacts.ps1
@@ -25,7 +25,7 @@ Function Test-ArtifactUploaded($artifactName) {
     Test-Path "env:$varName"
 }
 
-& "$PSScriptRoot/_stage_all.ps1" -ArtifactNameSuffix $ArtifactNameSuffix -AvoidSymbolicLinks:$AvoidSymbolicLinks |% {
+& "$PSScriptRoot/../tools/artifacts/_stage_all.ps1" -ArtifactNameSuffix $ArtifactNameSuffix -AvoidSymbolicLinks:$AvoidSymbolicLinks |% {
     # Set a variable which will out-live this script so that a subsequent attempt to collect and upload artifacts
     # will skip this one from a check in the _all.ps1 script.
     Set-PipelineVariable "ARTIFACTSTAGED_$($_.Name.ToUpper())" 'true'
diff --git a/init.ps1 b/init.ps1
index e2849855..b4004e79 100755
--- a/init.ps1
+++ b/init.ps1
@@ -71,7 +71,7 @@ if (!$NoPrerequisites) {
     # The procdump tool and env var is required for dotnet test to collect hang/crash dumps of tests.
     # But it only works on Windows.
     if ($env:OS -eq 'Windows_NT') {
-        $EnvVars['PROCDUMP_PATH'] = & "$PSScriptRoot\azure-pipelines\Get-ProcDump.ps1"
+        $EnvVars['PROCDUMP_PATH'] = & "$PSScriptRoot\tools\Get-ProcDump.ps1"
     }
 }
 
diff --git a/azure-pipelines/Get-ArtifactsStagingDirectory.ps1 b/tools/Get-ArtifactsStagingDirectory.ps1
similarity index 100%
rename from azure-pipelines/Get-ArtifactsStagingDirectory.ps1
rename to tools/Get-ArtifactsStagingDirectory.ps1
diff --git a/azure-pipelines/Get-CodeCovTool.ps1 b/tools/Get-CodeCovTool.ps1
similarity index 100%
rename from azure-pipelines/Get-CodeCovTool.ps1
rename to tools/Get-CodeCovTool.ps1
diff --git a/azure-pipelines/Get-LibTemplateBasis.ps1 b/tools/Get-LibTemplateBasis.ps1
similarity index 100%
rename from azure-pipelines/Get-LibTemplateBasis.ps1
rename to tools/Get-LibTemplateBasis.ps1
diff --git a/azure-pipelines/Get-NuGetTool.ps1 b/tools/Get-NuGetTool.ps1
similarity index 100%
rename from azure-pipelines/Get-NuGetTool.ps1
rename to tools/Get-NuGetTool.ps1
diff --git a/azure-pipelines/Get-ProcDump.ps1 b/tools/Get-ProcDump.ps1
similarity index 100%
rename from azure-pipelines/Get-ProcDump.ps1
rename to tools/Get-ProcDump.ps1
diff --git a/azure-pipelines/Get-SymbolFiles.ps1 b/tools/Get-SymbolFiles.ps1
similarity index 100%
rename from azure-pipelines/Get-SymbolFiles.ps1
rename to tools/Get-SymbolFiles.ps1
diff --git a/azure-pipelines/Get-TempToolsPath.ps1 b/tools/Get-TempToolsPath.ps1
similarity index 100%
rename from azure-pipelines/Get-TempToolsPath.ps1
rename to tools/Get-TempToolsPath.ps1
diff --git a/tools/Install-DotNetSdk.ps1 b/tools/Install-DotNetSdk.ps1
index ffb52203..e08571bc 100755
--- a/tools/Install-DotNetSdk.ps1
+++ b/tools/Install-DotNetSdk.ps1
@@ -36,7 +36,7 @@ if (!(Test-Path $DotNetInstallScriptRoot)) { New-Item -ItemType Directory -Path
 $DotNetInstallScriptRoot = Resolve-Path $DotNetInstallScriptRoot
 
 # Look up actual required .NET SDK version from global.json
-$sdkVersion = & "$PSScriptRoot/../azure-pipelines/variables/DotNetSdkVersion.ps1"
+$sdkVersion = & "$PSScriptRoot/variables/DotNetSdkVersion.ps1"
 
 If ($IncludeX86 -and ($IsMacOS -or $IsLinux)) {
     Write-Verbose "Ignoring -IncludeX86 switch because 32-bit runtimes are only supported on Windows."
diff --git a/tools/Install-NuGetCredProvider.ps1 b/tools/Install-NuGetCredProvider.ps1
index 2b904e33..b776f56d 100755
--- a/tools/Install-NuGetCredProvider.ps1
+++ b/tools/Install-NuGetCredProvider.ps1
@@ -21,7 +21,7 @@ Param (
 
 $envVars = @{}
 
-$toolsPath = & "$PSScriptRoot\..\azure-pipelines\Get-TempToolsPath.ps1"
+$toolsPath = & "$PSScriptRoot\Get-TempToolsPath.ps1"
 
 if ($IsMacOS -or $IsLinux) {
     $installerScript = "installcredprovider.sh"
diff --git a/tools/MergeFrom-Template.ps1 b/tools/MergeFrom-Template.ps1
index 3f721c6a..240a5709 100644
--- a/tools/MergeFrom-Template.ps1
+++ b/tools/MergeFrom-Template.ps1
@@ -36,7 +36,7 @@ Function Spawn-Tool($command, $commandArgs, $workingDirectory, $allowFailures) {
     }
 }
 
-$remoteBranch = & $PSScriptRoot\..\azure-pipelines\Get-LibTemplateBasis.ps1 -ErrorIfNotRelated
+$remoteBranch = & $PSScriptRoot\Get-LibTemplateBasis.ps1 -ErrorIfNotRelated
 if ($LASTEXITCODE -ne 0) {
     exit $LASTEXITCODE
 }
diff --git a/azure-pipelines/artifacts/Variables.ps1 b/tools/artifacts/Variables.ps1
similarity index 100%
rename from azure-pipelines/artifacts/Variables.ps1
rename to tools/artifacts/Variables.ps1
diff --git a/azure-pipelines/artifacts/_all.ps1 b/tools/artifacts/_all.ps1
old mode 100755
new mode 100644
similarity index 100%
rename from azure-pipelines/artifacts/_all.ps1
rename to tools/artifacts/_all.ps1
diff --git a/azure-pipelines/artifacts/_stage_all.ps1 b/tools/artifacts/_stage_all.ps1
similarity index 96%
rename from azure-pipelines/artifacts/_stage_all.ps1
rename to tools/artifacts/_stage_all.ps1
index bf961ce5..08e9844c 100644
--- a/azure-pipelines/artifacts/_stage_all.ps1
+++ b/tools/artifacts/_stage_all.ps1
@@ -11,7 +11,7 @@ param (
     [switch]$AvoidSymbolicLinks
 )
 
-$ArtifactStagingFolder = & "$PSScriptRoot/../Get-ArtifactsStagingDirectory.ps1" -CleanIfLocal
+$ArtifactStagingFolder = & "$PSScriptRoot/../../tools/Get-ArtifactsStagingDirectory.ps1" -CleanIfLocal
 
 function Create-SymbolicLink {
     param (
diff --git a/azure-pipelines/artifacts/build_logs.ps1 b/tools/artifacts/build_logs.ps1
similarity index 66%
rename from azure-pipelines/artifacts/build_logs.ps1
rename to tools/artifacts/build_logs.ps1
index f05358e0..10c5478b 100644
--- a/azure-pipelines/artifacts/build_logs.ps1
+++ b/tools/artifacts/build_logs.ps1
@@ -1,4 +1,4 @@
-$ArtifactStagingFolder = & "$PSScriptRoot/../Get-ArtifactsStagingDirectory.ps1"
+$ArtifactStagingFolder = & "$PSScriptRoot/../../tools/Get-ArtifactsStagingDirectory.ps1"
 
 if (!(Test-Path $ArtifactStagingFolder/build_logs)) { return }
 
diff --git a/azure-pipelines/artifacts/coverageResults.ps1 b/tools/artifacts/coverageResults.ps1
similarity index 100%
rename from azure-pipelines/artifacts/coverageResults.ps1
rename to tools/artifacts/coverageResults.ps1
diff --git a/azure-pipelines/artifacts/deployables.ps1 b/tools/artifacts/deployables.ps1
similarity index 100%
rename from azure-pipelines/artifacts/deployables.ps1
rename to tools/artifacts/deployables.ps1
diff --git a/azure-pipelines/artifacts/projectAssetsJson.ps1 b/tools/artifacts/projectAssetsJson.ps1
similarity index 100%
rename from azure-pipelines/artifacts/projectAssetsJson.ps1
rename to tools/artifacts/projectAssetsJson.ps1
diff --git a/azure-pipelines/artifacts/symbols.ps1 b/tools/artifacts/symbols.ps1
similarity index 100%
rename from azure-pipelines/artifacts/symbols.ps1
rename to tools/artifacts/symbols.ps1
diff --git a/azure-pipelines/artifacts/testResults.ps1 b/tools/artifacts/testResults.ps1
similarity index 100%
rename from azure-pipelines/artifacts/testResults.ps1
rename to tools/artifacts/testResults.ps1
diff --git a/azure-pipelines/artifacts/test_symbols.ps1 b/tools/artifacts/test_symbols.ps1
similarity index 100%
rename from azure-pipelines/artifacts/test_symbols.ps1
rename to tools/artifacts/test_symbols.ps1
diff --git a/azure-pipelines/dotnet-test-cloud.ps1 b/tools/dotnet-test-cloud.ps1
similarity index 100%
rename from azure-pipelines/dotnet-test-cloud.ps1
rename to tools/dotnet-test-cloud.ps1
diff --git a/azure-pipelines/publish-CodeCov.ps1 b/tools/publish-CodeCov.ps1
similarity index 100%
rename from azure-pipelines/publish-CodeCov.ps1
rename to tools/publish-CodeCov.ps1
diff --git a/azure-pipelines/test.runsettings b/tools/test.runsettings
similarity index 100%
rename from azure-pipelines/test.runsettings
rename to tools/test.runsettings
diff --git a/azure-pipelines/variables/DotNetSdkVersion.ps1 b/tools/variables/DotNetSdkVersion.ps1
similarity index 100%
rename from azure-pipelines/variables/DotNetSdkVersion.ps1
rename to tools/variables/DotNetSdkVersion.ps1
diff --git a/azure-pipelines/variables/_all.ps1 b/tools/variables/_all.ps1
old mode 100755
new mode 100644
similarity index 100%
rename from azure-pipelines/variables/_all.ps1
rename to tools/variables/_all.ps1
diff --git a/azure-pipelines/variables/_pipelines.ps1 b/tools/variables/_define.ps1
similarity index 100%
rename from azure-pipelines/variables/_pipelines.ps1
rename to tools/variables/_define.ps1