diff --git a/auto-discovery/cloud-aws/Makefile b/auto-discovery/cloud-aws/Makefile
index 4b041ac9c..53211f526 100644
--- a/auto-discovery/cloud-aws/Makefile
+++ b/auto-discovery/cloud-aws/Makefile
@@ -13,10 +13,12 @@ IMG ?= auto-discovery-cloud-aws
 IMG_TAG ?= sha-$$(git rev-parse --short HEAD)
 
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.24.2
+# Derived automatically from k8s.io/api in go.mod - updated by renovate via go.mod.
+ENVTEST_K8S_VERSION ?= $(shell v='$(call gomodver,k8s.io/api)'; printf '%s\n' "$$v" | sed -E 's/^v?[0-9]+\.([0-9]+).*/1.\1/')
 
-# SETUP_ENVTEST_VERSION refers to the version of setup-envtest binary.
-SETUP_ENVTEST_VERSION = v0.0.0-20230216140739-c98506dc3b8e
+# ENVTEST_VERSION refers to the version of setup-envtest binary.
+# Derived automatically from sigs.k8s.io/controller-runtime in go.mod - updated by renovate via go.mod.
+ENVTEST_VERSION ?= $(shell v='$(call gomodver,sigs.k8s.io/controller-runtime)'; printf '%s\n' "$$v" | sed -E 's/^v?([0-9]+)\.([0-9]+).*/release-\1.\2/')
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set).
 # IMPORTANT: The body of conditionals MUST not be indented! Indentation result in
@@ -66,11 +68,11 @@ vet: ## Run go vet against code.
 
 .PHONY: test
 test: fmt vet envtest ## Run tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test ./... -coverprofile cover.out
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test ./... -coverprofile cover.out
 
 .PHONY: ginkgo
 ginkgo: fmt vet envtest ## Run tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" $(GOBIN)/ginkgo test ./... -coverprofile cover.out -v --progress
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" $(GOBIN)/ginkgo test ./... -coverprofile cover.out -v --progress
 
 ## Helm unit tests
 .PHONY: helm-unit-tests
@@ -130,16 +132,35 @@ $(LOCALBIN):
 ENVTEST ?= $(LOCALBIN)/setup-envtest
 
 .PHONY: envtest
-envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
+envtest: $(ENVTEST) ## Download setup-envtest locally if necessary.
 $(ENVTEST): $(LOCALBIN)
-	test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@$(SETUP_ENVTEST_VERSION)
+	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION))
 
 .PHONY: print-envtest-path
 print-envtest-path: ## Print the path of the envtest binaries for use with other tools
 # suppress output so that result can be stored as env var
 	@$(MAKE) -s envtest
-	@$(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path
+	@$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path
 
 debug.env: ## Allow vscode profiles to access the envtest assets
 	printf '%s' 'KUBEBUILDER_ASSETS=' > debug.env
 	$(MAKE) print-envtest-path >> debug.env
+
+# go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
+# $1 - target path with name of binary
+# $2 - package url which can be installed
+# $3 - specific version of package
+define go-install-tool
+@[ -f "$(1)-$(3)" ] && [ "$$(readlink -- "$(1)" 2>/dev/null)" = "$(1)-$(3)" ] || { \
+set -e; \
+package=$(2)@$(3) ;\
+echo "Downloading $${package}" ;\
+rm -f "$(1)" ;\
+GOBIN="$(LOCALBIN)" go install $${package} ;\
+mv "$(LOCALBIN)/$$(basename "$(1)")" "$(1)-$(3)" ;\
+} ;\
+ln -sf "$$(realpath "$(1)-$(3)")" "$(1)"
+endef
+define gomodver
+$(shell go list -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' $(1) 2>/dev/null)
+endef
\ No newline at end of file
diff --git a/auto-discovery/kubernetes/Makefile b/auto-discovery/kubernetes/Makefile
index df6a61958..62911c16c 100644
--- a/auto-discovery/kubernetes/Makefile
+++ b/auto-discovery/kubernetes/Makefile
@@ -13,7 +13,8 @@ IMG ?= auto-discovery-kubernetes
 IMG_TAG ?= sha-$$(git rev-parse --short HEAD)
 
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.33.0
+# Derived automatically from k8s.io/api in go.mod - updated by renovate via go.mod.
+ENVTEST_K8S_VERSION ?= $(shell v='$(call gomodver,k8s.io/api)'; printf '%s\n' "$$v" | sed -E 's/^v?[0-9]+\.([0-9]+).*/1.\1/')
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set).
 # IMPORTANT: The body of conditionals MUST not be indented! Indentation result in
@@ -141,12 +142,14 @@ $(LOCALBIN):
 	mkdir -p $(LOCALBIN)
 
 ## Tool Binaries
-CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
-ENVTEST ?= $(LOCALBIN)/setup-envtest-$(ENVTEST_VERSION)
+CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
+ENVTEST ?= $(LOCALBIN)/setup-envtest
 
 ## Tool Versions
+# renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools
 CONTROLLER_TOOLS_VERSION ?= v0.18.0
-ENVTEST_VERSION ?= release-0.21
+# Derived automatically from sigs.k8s.io/controller-runtime in go.mod - updated by renovate via go.mod.
+ENVTEST_VERSION ?= $(shell v='$(call gomodver,sigs.k8s.io/controller-runtime)'; printf '%s\n' "$$v" | sed -E 's/^v?([0-9]+)\.([0-9]+).*/release-\1.\2/')
 
 .PHONY: controller-gen
 controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
@@ -159,15 +162,20 @@ $(ENVTEST): $(LOCALBIN)
 	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION))
 
 # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
-# $1 - target path with name of binary (ideally with version)
+# $1 - target path with name of binary
 # $2 - package url which can be installed
 # $3 - specific version of package
 define go-install-tool
-@[ -f $(1) ] || { \
+@[ -f "$(1)-$(3)" ] && [ "$$(readlink -- "$(1)" 2>/dev/null)" = "$(1)-$(3)" ] || { \
 set -e; \
 package=$(2)@$(3) ;\
 echo "Downloading $${package}" ;\
-GOBIN=$(LOCALBIN) go install $${package} ;\
-mv "$$(echo "$(1)" | sed "s/-$(3)$$//")" $(1) ;\
-}
+rm -f "$(1)" ;\
+GOBIN="$(LOCALBIN)" go install $${package} ;\
+mv "$(LOCALBIN)/$$(basename "$(1)")" "$(1)-$(3)" ;\
+} ;\
+ln -sf "$$(realpath "$(1)-$(3)")" "$(1)"
 endef
+define gomodver
+$(shell go list -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' $(1) 2>/dev/null)
+endef
\ No newline at end of file
diff --git a/operator/Makefile b/operator/Makefile
index 31da384e5..4410f947e 100644
--- a/operator/Makefile
+++ b/operator/Makefile
@@ -11,7 +11,8 @@ PROJECT_DIR=..
 IMG_NS ?= securecodebox
 
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.33.0
+# Derived automatically from k8s.io/api in go.mod - updated by renovate via go.mod.
+ENVTEST_K8S_VERSION ?= $(shell v='$(call gomodver,k8s.io/api)'; printf '%s\n' "$$v" | sed -E 's/^v?[0-9]+\.([0-9]+).*/1.\1/')
 
 # Image URL to use all building/pushing image targets for the operator
 OPERATOR_IMG ?= operator
@@ -174,12 +175,14 @@ $(LOCALBIN):
 	mkdir -p $(LOCALBIN)
 
 ## Tool Binaries
-CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
-ENVTEST ?= $(LOCALBIN)/setup-envtest-$(ENVTEST_VERSION)
+CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
+ENVTEST ?= $(LOCALBIN)/setup-envtest
 
 ## Tool Versions
+# renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools
 CONTROLLER_TOOLS_VERSION ?= v0.18.0
-ENVTEST_VERSION ?= release-0.21
+# Derived automatically from sigs.k8s.io/controller-runtime in go.mod - updated by renovate via go.mod.
+ENVTEST_VERSION ?= $(shell v='$(call gomodver,sigs.k8s.io/controller-runtime)'; printf '%s\n' "$$v" | sed -E 's/^v?([0-9]+)\.([0-9]+).*/release-\1.\2/')
 
 .PHONY: controller-gen
 controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
@@ -192,15 +195,20 @@ $(ENVTEST): $(LOCALBIN)
 	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION))
 
 # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
-# $1 - target path with name of binary (ideally with version)
+# $1 - target path with name of binary
 # $2 - package url which can be installed
 # $3 - specific version of package
 define go-install-tool
-@[ -f $(1) ] || { \
+@[ -f "$(1)-$(3)" ] && [ "$$(readlink -- "$(1)" 2>/dev/null)" = "$(1)-$(3)" ] || { \
 set -e; \
 package=$(2)@$(3) ;\
 echo "Downloading $${package}" ;\
-GOBIN=$(LOCALBIN) go install $${package} ;\
-mv "$$(echo "$(1)" | sed "s/-$(3)$$//")" $(1) ;\
-}
+rm -f "$(1)" ;\
+GOBIN="$(LOCALBIN)" go install $${package} ;\
+mv "$(LOCALBIN)/$$(basename "$(1)")" "$(1)-$(3)" ;\
+} ;\
+ln -sf "$$(realpath "$(1)-$(3)")" "$(1)"
 endef
+define gomodver
+$(shell go list -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' $(1) 2>/dev/null)
+endef
\ No newline at end of file
diff --git a/renovate.json b/renovate.json
index 38ce5f46f..a03a40480 100644
--- a/renovate.json
+++ b/renovate.json
@@ -42,6 +42,19 @@
         "# renovate: datasource=github-releases depName=(?<depName>.*?)\\s*\\w+_VERSION:\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
       ],
       "datasourceTemplate": "github-releases"
+    },
+    {
+      "customType": "regex",
+      "description": "Update pinned tool versions in Makefiles (e.g. CONTROLLER_TOOLS_VERSION)",
+      "managerFilePatterns": [
+        "/operator/Makefile$",
+        "/auto-discovery/cloud-aws/Makefile$",
+        "/auto-discovery/kubernetes/Makefile$"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s*\\w+[_A-Z]* [?]?= (?<currentValue>[^\\s]+)"
+      ],
+      "datasourceTemplate": "github-releases"
     }
   ]
 }