diff --git a/ops/renovate/run-renovate.sh b/ops/renovate/run-renovate.sh
index dd03815..da13132 100644
--- a/ops/renovate/run-renovate.sh
+++ b/ops/renovate/run-renovate.sh
@@ -21,6 +21,11 @@ RENOVATE_TOKEN_FILE="${RENOVATE_TOKEN_FILE:-/mnt/user/appdata/secrets/renovate_t
 RENOVATE_LOG_DIR="${RENOVATE_LOG_DIR:-/mnt/user/services/renovate/logs}"
 RENOVATE_STATE_DIR="${RENOVATE_STATE_DIR:-/mnt/user/services/renovate/state}"
 RENOVATE_CONFIG_FILE="${RENOVATE_CONFIG_FILE:-/mnt/user/services/homelab-infra/renovate.json}"
+# Gitea sitzt hinter Traefik unter git.kaleschke.info; der WAN-Pfad geht
+# ueber Public-IP -> FRITZBox. Vom Docker-Container aus loest der Standard-
+# Resolver den Host moeglicherweise nicht auf (siehe `extra_hosts` im Komodo-
+# Compose). Wir mappen direkt auf die LAN-IP des Unraid-Hosts.
+GITEA_HOST_LAN_IP="${GITEA_HOST_LAN_IP:-192.168.178.58}"
 
 if [ ! -r "$RENOVATE_TOKEN_FILE" ]; then
   echo "Renovate token file missing or unreadable: $RENOVATE_TOKEN_FILE" >&2
@@ -48,18 +53,32 @@ LATEST_SYMLINK="$RENOVATE_LOG_DIR/latest.log"
   echo "[renovate] log:      $LOG_FILE"
   echo
 
+  # Token wird ueber --env-file uebergeben, damit der Wert weder in
+  # `ps`-Ausgabe noch im docker inspect -Snapshot landet. Das Env-File
+  # liegt unter $RENOVATE_STATE_DIR/.env und wird mit 0600 angelegt.
+  ENV_FILE="$RENOVATE_STATE_DIR/.env"
+  umask 077
+  cat > "$ENV_FILE" <<EFEOF
+RENOVATE_TOKEN=$(cat "$RENOVATE_TOKEN_FILE")
+RENOVATE_CONFIG_FILE=/usr/src/app/config.json
+RENOVATE_PLATFORM=gitea
+RENOVATE_ENDPOINT=https://git.kaleschke.info/api/v1
+LOG_LEVEL=${RENOVATE_LOG_LEVEL:-info}
+EFEOF
+  chmod 600 "$ENV_FILE"
+
   docker run --rm \
     --name renovate-run \
+    --add-host "git.kaleschke.info:$GITEA_HOST_LAN_IP" \
+    --dns 1.1.1.1 \
+    --dns 8.8.8.8 \
     -v "$RENOVATE_CONFIG_FILE":/usr/src/app/config.json:ro \
     -v "$RENOVATE_STATE_DIR":/tmp/renovate \
-    -e RENOVATE_CONFIG_FILE=/usr/src/app/config.json \
-    -e RENOVATE_PLATFORM=gitea \
-    -e RENOVATE_ENDPOINT=https://git.kaleschke.info/api/v1 \
-    -e RENOVATE_TOKEN="$(cat "$RENOVATE_TOKEN_FILE")" \
-    -e LOG_LEVEL="${RENOVATE_LOG_LEVEL:-info}" \
+    --env-file "$ENV_FILE" \
     "$RENOVATE_IMAGE" 2>&1
-
   rc=$?
+  shred -u "$ENV_FILE" 2>/dev/null || rm -f "$ENV_FILE"
+
   echo
   echo "[renovate] finished rc=$rc"
   exit $rc