diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 18649af..f845c64 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -32,12 +32,7 @@ jobs:
         with:
           node-version: 22
 
-      # Pinned so CI does not silently execute whatever renovate publishes next.
+      # The pinned renovate version lives in the script, so CI and a local run
+      # cannot drift. renovate.json keeps that pin updated.
       - name: Validate all presets
-        env:
-          # renovate: datasource=npm depName=renovate
-          RENOVATE_VERSION: 44.39.1
-        run: |
-          npx --yes --package "renovate@${RENOVATE_VERSION}" -- \
-            renovate-config-validator --strict default.json renovate.json \
-              lockdown.json aggressive.json no-automerge.json
+        run: ./tooling/validate.sh
diff --git a/README.md b/README.md
index f88a11a..5f1f67f 100644
--- a/README.md
+++ b/README.md
@@ -91,8 +91,32 @@ Drop this file into a new repo and you are done:
 That is the whole setup. The preset carries the schedule, grouping, automerge
 policy and ecosystem coverage — there is nothing else to configure per repo.
 
-The one prerequisite is that the **Mend Renovate App** is installed for the
-account or org and has access to the repo.
+Two prerequisites, both one-time:
+
+1. **Renovate reaches the repo.** On GitHub.com that is the Mend Renovate App,
+   installed for the account or org. On every other forge you run Renovate
+   yourself — see below.
+2. **Allow auto-merge** is enabled in the repo's settings. This preset sets
+   `platformAutomerge`, which uses GitHub's native auto-merge. With the repo
+   setting off, Renovate silently falls back to merging through its own bot
+   instead — it still works, but not the way this preset describes.
+
+### Where Renovate runs
+
+The preset is only JSON; it works wherever Renovate does. Getting Renovate to
+run is the part that differs, and only GitHub.com is free of setup:
+
+| Forge | How Renovate runs |
+| --- | --- |
+| GitHub.com | Mend Renovate App — hosted, free, nothing to run |
+| GitLab | self-hosted; the [`renovate-runner`](https://gitlab.com/renovate-bot/renovate-runner) CI template runs it as a scheduled pipeline |
+| Codeberg / Forgejo / Gitea | self-hosted; run the Renovate CLI on a schedule |
+| Bitbucket | self-hosted |
+
+This is a property of the Renovate ecosystem, not of this preset — you would
+face it with any preset, or with none. Mirroring this repo to another forge is
+about making `local>ownctrl/supply-chain` resolvable there; nothing runs on
+the mirror itself.
 
 ### What to expect on a fresh repo
 
@@ -193,6 +217,22 @@ lockfile refreshes are performed by the incumbent package manager, not by nub.
 | `vulnerabilityAlerts` | ✅ enabled | With security labels |
 | `lockFileMaintenance` | ✅ weekly | Review required — the age gate does not apply here |
 
+## Validating locally
+
+```bash
+./tooling/validate.sh
+```
+
+Same list of presets CI checks. Wire it up as a pre-push hook if you want it to
+run on its own:
+
+```bash
+ln -s ../../tooling/validate.sh .git/hooks/pre-push
+```
+
+A local hook is a convenience, not a boundary — anyone can skip it. CI stays the
+real gate.
+
 ## Testing locally
 
 You can test this config locally before deploying:
diff --git a/renovate.json b/renovate.json
index ee8bd08..0a27d99 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,7 +2,18 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "description": "This repo eats its own dog food: it consumes the preset it publishes. Without this, the action digests and the pinned renovate version in .github/workflows/ would rot, and a stale pin is worse than a floating tag.",
   "extends": [
-    "local>ownctrl/supply-chain",
-    "customManagers:githubActionsVersions"
+    "local>ownctrl/supply-chain"
+  ],
+  "customManagers": [
+    {
+      "description": "Keep the validator pin in tooling/validate.sh updated",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^tooling/validate\\.sh$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+RENOVATE_VERSION=\"\\$\\{RENOVATE_VERSION:-(?<currentValue>[^}\"]+)\\}\""
+      ]
+    }
   ]
 }
diff --git a/tooling/validate.sh b/tooling/validate.sh
new file mode 100755
index 0000000..a569c38
--- /dev/null
+++ b/tooling/validate.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Validate every preset in this repo.
+#
+# This mirrors what .github/workflows/validate.yml runs in CI. It exists so the
+# gate still works when CI does not -- run it before pushing, or wire it up as
+# a pre-push hook:
+#
+#   ln -s ../../tooling/validate.sh .git/hooks/pre-push
+#
+# It is a convenience, not an enforcement boundary: anyone can skip a local
+# hook. CI remains the real gate.
+set -euo pipefail
+
+# renovate: datasource=npm depName=renovate
+RENOVATE_VERSION="${RENOVATE_VERSION:-44.39.1}"
+
+cd "$(dirname "$0")/.."
+
+presets=(default.json renovate.json lockdown.json aggressive.json no-automerge.json)
+
+missing=()
+for f in "${presets[@]}"; do
+  [[ -f "$f" ]] || missing+=("$f")
+done
+if [[ ${#missing[@]} -gt 0 ]]; then
+  printf 'missing preset(s): %s\n' "${missing[*]}" >&2
+  echo "if a preset was renamed, update this list and the CI workflow together" >&2
+  exit 1
+fi
+
+echo "validating ${#presets[@]} presets against renovate@${RENOVATE_VERSION}"
+npx --yes --package "renovate@${RENOVATE_VERSION}" -- \
+  renovate-config-validator --strict "${presets[@]}"