diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9d244c0e..4e87d0d9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,7 +10,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  RENOVATE_VERSION: 43.2.0 # renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
+  RENOVATE_VERSION: 43.2.1 # renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
 
 jobs:
   prepare:
@@ -117,7 +117,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     container:
-      image: ghcr.io/renovatebot/renovate:43.2.0@sha256:c05eb9fd652a44a647ea8faeeee91739018e4f3eccd629070c5562d5f3290174
+      image: ghcr.io/renovatebot/renovate:43.2.1@sha256:4146ffd09c5c8311d0d54576ce3fb2ddab5dbb77be62390b6f57185b5bb2c01a
       # github hosted runners are running as `1001:127` (ubuntu:docker)
       options: -u 1001:0 --group-add 1000 --group-add 12021 --group-add 127
 
diff --git a/README.md b/README.md
index 411f5a39..b99471b6 100644
--- a/README.md
+++ b/README.md
@@ -222,7 +222,7 @@ The Renovate version to use.
 If omitted the action will use the [`default version`](./action.yml#L28) Docker tag.
 Check [the available tags on Docker Hub](https://hub.docker.com/r/renovate/renovate/tags).
 
-This sample will use `ghcr.io/renovatebot/renovate:43.2.0` image.
+This sample will use `ghcr.io/renovatebot/renovate:43.2.1` image.
 
 ```yml
 ....
@@ -235,7 +235,7 @@ jobs:
       - name: Self-hosted Renovate
         uses: renovatebot/github-action@v46.0.1
         with:
-          renovate-version: 43.2.0
+          renovate-version: 43.2.1
           token: ${{ secrets.RENOVATE_TOKEN }}
 ```
 
@@ -516,7 +516,7 @@ jobs:
         with:
           configurationFile: renovate.json5
           token: ${{ secrets.RENOVATE_TOKEN }}
-          renovate-version: 43.2.0
+          renovate-version: 43.2.1
         env:
           # This enables the cache -- if this is set, it's not necessary to add it to renovate.json.
           RENOVATE_REPOSITORY_CACHE: ${{ github.event.inputs.repoCache || 'enabled' }}