diff --git a/.woodpecker/lint.yaml b/.woodpecker/lint.yaml
index 7f9a83e..41ecded 100644
--- a/.woodpecker/lint.yaml
+++ b/.woodpecker/lint.yaml
@@ -7,6 +7,7 @@ steps:
 
   renovate:
     image: kokuwaio/renovate-config-validator
+    pull: true
     depends_on: []
     when: [path: [.woodpecker/lint.yaml, renovate.json]]
 
diff --git a/Dockerfile b/Dockerfile
index eed755c..0bceec7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,14 @@
 FROM docker.io/library/bash:5.2.37@sha256:01a15c6f48f6a3c08431cd77e11567823530b18159889dca3b7309b707beef91
-RUN set -o pipefail && ARCH=$(uname -m) && \
+SHELL ["/bin/bash", "-u", "-e", "-o", "pipefail", "-c"]
+# ignore pipefail because
+# bash is non-default location https://github.com/tianon/docker-bash/issues/29
+# hadolint only uses default locations https://github.com/hadolint/hadolint/issues/977
+# hadolint ignore=DL4006
+RUN ARCH=$(uname -m) && \
 	[[ $ARCH == x86_64 ]] && export SUFFIX=amd64; \
 	[[ $ARCH == aarch64 ]] && export SUFFIX=arm64; \
 	[[ -z ${SUFFIX:-} ]] && echo "Unknown arch: $ARCH" && exit 1; \
+	set -o pipefail && \
 	wget -q "https://github.com/moby/buildkit/releases/download/v0.21.0/buildkit-v0.21.0.linux-$SUFFIX.tar.gz" --output-document=- | \
 	tar --gz --extract --directory=/usr/local bin/buildctl
 COPY --chmod=555 entrypoint.sh /usr/local/bin/entrypoint.sh
diff --git a/entrypoint.sh b/entrypoint.sh
index d1f3c28..5e9b9b5 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,4 +1,4 @@
-#!/usr/local/bin/bash
+#!/usr/bin/env bash
 set -exu;
 env | sort | grep -v DRONE
 
@@ -39,7 +39,7 @@ if [[ "${PLUGIN_PLATFORM:-}" == "true" ]]; then
 	COMMAND="$COMMAND --opt platform='$PLUGIN_PLATFORM'"
 fi
 # https://github.com/moby/buildkit/blob/master/README.md#output
-if [[ ! -z "${PLUGIN_NAMES:-}" ]]; then
+if [[ -n "${PLUGIN_NAMES:-}" ]]; then
 	COMMAND="$COMMAND --output type=image,name=$PLUGIN_NAMES,push=${PLUGIN_PUSH:-true}"
 fi
 
diff --git a/renovate.json b/renovate.json
index bc736bf..721919f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -39,13 +39,14 @@
 	"customManagers": [
 		{
 			"customType": "regex",
-			"fileMatch": ["Dockerfile", ".woodpecker/build.yaml"],
+			"managerFilePatterns": ["Dockerfile", ".woodpecker/build.yaml"],
 			"matchStrings": [
 				"- registry.kokuwa.io/buildctl:(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)",
 				"- docker.io/kokuwaio/buildctl:(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)",
 				"- ghcr.io/kokuwaio/buildctl:(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)",
-				"github.com/moby/buildkit/releases/download/(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)/buildkit-(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+).linux-$SUFFIX.tar.gz",
-				"org.opencontainers.image.version: (?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)"
+				"org.opencontainers.image.version: (?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)",
+				"https://github.com/moby/buildkit/releases/download/(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)/buildkit-v[0-9]+\\.[0-9]+\\.[0-9]+.linux-$SUFFIX.tar.gz",
+				"https://github.com/moby/buildkit/releases/download/v[0-9]+\\.[0-9]+\\.[0-9]+/buildkit-(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+).linux-$SUFFIX.tar.gz"
 			],
 			"datasourceTemplate": "github-tags",
 			"packageNameTemplate": "moby/buildkit"