diff --git a/compose.yml b/compose.yml
index 0aed3cd..fb3e4cc 100644
--- a/compose.yml
+++ b/compose.yml
@@ -4,11 +4,18 @@ services:
     image: "renovate/renovate:24.119.22-slim"
     environment:
       LOG_LEVEL: info
+      GITHUB_COM_TOKEN_FILE: /run/secrets/github_token
     configs:
       - source: config_js
         target: /usr/src/app/config.js
+      - source: entrypoint
+        target: /docker-entrypoint.sh
+        mode: 0555
+    entrypoint: /docker-entrypoint.sh
+    command: renovate
     secrets:
       - api_token
+      - github_token
     healthcheck:
       disable: true
     deploy:
@@ -16,7 +23,9 @@ services:
       replicas: 0
       labels:
         - "swarm.cronjob.enable=true"
-        - "swarm.cronjob.schedule=0 9 * * 1-5"
+        # Note(decentral1se): every minute, testing
+        # - "swarm.cronjob.schedule=* * * * *"
+        - "swarm.cronjob.schedule=0 9 * * 1-5" # office hours
         - coop-cloud.${STACK_NAME}.app.version=24.98.9-slim-d3db1c25
       restart_policy:
         condition: none
@@ -29,3 +38,6 @@ secrets:
   api_token:
     name: api_token_v1
     external: true
+  github_token:
+    name: github_token_v1
+    external: true
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..3ccc9ca
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -e
+
+file_env() {
+   local var="$1"
+   local fileVar="${var}_FILE"
+   local def="${2:-}"
+
+   if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+      echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+      exit 1
+   fi
+
+   local val="$def"
+
+   if [ "${!var:-}" ]; then
+      val="${!var}"
+   elif [ "${!fileVar:-}" ]; then
+      val="$(< "${!fileVar}")"
+   fi
+
+   export "$var"="$val"
+   unset "$fileVar"
+}
+
+file_env "GITHUB_COM_TOKEN"
+
+exec "$@"