diff --git a/.github/renovate.json b/.github/renovate.json
index 0f8a10f..981e6e8 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -10,7 +10,6 @@
     {
       "customType": "regex",
       "managerFilePatterns": [
-        "/^values.yaml.gotmpl$/",
         "/^versions.yaml$/",
         "/^Makefile$/",
         "/^\\.github/workflows/.+\\.yaml$/"
diff --git a/helmfile.yaml.gotmpl b/helmfile.yaml.gotmpl
index 8c871b9..ab57a4e 100644
--- a/helmfile.yaml.gotmpl
+++ b/helmfile.yaml.gotmpl
@@ -376,7 +376,7 @@ releases:
         file: {{ .Values.certsDir }}/ca.crt
     values:
       - stacks:
-          cflinuxfs4: ghcr.io/cloudfoundry/k8s/cflinuxfs4:{{ .Values.stacks.cflinuxfs4.version }}
+          cflinuxfs4: {{ .Values.stacks.cflinuxfs4.image }}:{{ .Values.stacks.cflinuxfs4.tag }}
       - workloadsNamespace: {{ .Values.workloadsNamespace }}
       - containerProxyVerifySubjectAltName:
           - gorouter
diff --git a/scripts/sync-cf-deployment-versions.py b/scripts/sync-cf-deployment-versions.py
index 1fc2e25..1a360d9 100755
--- a/scripts/sync-cf-deployment-versions.py
+++ b/scripts/sync-cf-deployment-versions.py
@@ -18,6 +18,7 @@
     "routing": "routing",
     "uaa": "uaa",
     "nfs-volume": "nfsVolume",
+    "cflinuxfs4": "cflinuxfs4",
 }
 
 BUILDPACKS = [
@@ -34,6 +35,12 @@
     "staticfile-buildpack",
 ]
 
+STACKS = [
+    "cflinuxfs4",
+]
+
+MANAGED_RELEASES = set(BOSH_RELEASES.keys()) | set(BUILDPACKS) | set(STACKS)
+
 
 def latest_cf_deployment_release() -> str:
     headers = {"Authorization": f"Bearer {os.environ['GITHUB_TOKEN']}"}
@@ -116,7 +123,7 @@ def main():
         release_versions["cf-deployment"] = manifest_version
 
     for r in releases:
-        if (r["name"] not in BOSH_RELEASES) and (r["name"] not in BUILDPACKS):
+        if r["name"] not in MANAGED_RELEASES:
             print(
                 f"Skipping release update of '{r['name']}': not a managed release",
                 file=sys.stderr,
@@ -129,6 +136,9 @@ def main():
         elif r["name"] in BUILDPACKS and r["name"] in values.get("buildpacks", {}):
             values["buildpacks"][r["name"]]["tag"] = str(r["version"])
             print(f"Updated buildpack '{r['name']}' to version {r['version']}")
+        elif r["name"] in STACKS and r["name"] in values.get("stacks", {}):
+            values["stacks"][r["name"]]["tag"] = str(r["version"])
+            print(f"Updated stack '{r['name']}' to version {r['version']}")
         else:
             print(
                 f"error in release update of '{r['name']}': no value found",
diff --git a/values.yaml.gotmpl b/values.yaml.gotmpl
index 9e6f32c..91a2bfc 100644
--- a/values.yaml.gotmpl
+++ b/values.yaml.gotmpl
@@ -3,11 +3,6 @@ certsDir: "./temp/certs"
 systemNamespace: "cf-system"
 workloadsNamespace: "cf-workloads"
 
-stacks:
-  cflinuxfs4:
-    # renovate: dataSource=docker depName=cloudfoundry/cflinuxfs4-release packageName=ghcr.io/cloudfoundry/k8s/cflinuxfs4
-    version: "1.321.0"
-
 installOptionalComponents: {{ "INSTALL_OPTIONAL_COMPONENTS" | env | default "true" }}
 secrets:
   dbPassword: {{ requiredEnv "DB_PASSWORD" }}
diff --git a/versions.yaml b/versions.yaml
index 7a853b8..916cb4a 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -55,7 +55,6 @@ charts:
   uaa:
     url: cloudfoundry-k8s/uaa
     version: 78.16.0
-
 buildpacks:
   binary-buildpack:
     image: ghcr.io/cloudfoundry/k8s/binary-buildpack
@@ -90,3 +89,7 @@ buildpacks:
   staticfile-buildpack:
     image: ghcr.io/cloudfoundry/k8s/staticfile-buildpack
     tag: 1.6.38
+stacks:
+  cflinuxfs4:
+    image: ghcr.io/cloudfoundry/k8s/cflinuxfs4
+    tag: 1.321.0