diff --git a/.crow/build.yaml b/.crow/build.yaml
index 1ab6777..554931a 100644
--- a/.crow/build.yaml
+++ b/.crow/build.yaml
@@ -53,11 +53,11 @@ matrix:
       ARCH: amd64
       ARCH_ID: amd64
       INSTANCE_TYPE: AX42
-    - PLATFORM: alpine-320
-      PLATFORM_ID: alpine320
-      ARCH: arm64
-      ARCH_ID: aarch64
-      INSTANCE_TYPE: cax31
+    # - PLATFORM: alpine-320
+    #   PLATFORM_ID: alpine320
+    #   ARCH: arm64
+    #   ARCH_ID: aarch64
+    #   INSTANCE_TYPE: cax31
     - PLATFORM: alpine-321
       PLATFORM_ID: alpine321
       ARCH: arm64
@@ -97,9 +97,9 @@ steps:
     image: alpine:3.22
     commands:
       - apk add -q --no-cache curl
-      - curl -s https://raw.githubusercontent.com/Homebrew/homebrew-core/master/Formula/r/r.rb | grep -o 'R-[0-9]*\.[0-9]*\.[0-9]*' | tr -d 'R-' | tr -d '"' | head -n 1 > r-release-version.txt
-      - echo "4.3.3" > r-release-version.txt
-      - cat r-release-version.txt
+      - curl -s https://raw.githubusercontent.com/Homebrew/homebrew-core/master/Formula/r/r.rb | grep -o 'R-[0-9]*\.[0-9]*\.[0-9]*' | tr -d 'R-' | tr -d '"' | head -n 1 > r-version-to-build.txt
+      # - echo "4.1.3" > r-version-to-build.txt
+      - cat r-version-to-build.txt
     backend_options:
       kubernetes:
         resources:
@@ -128,8 +128,12 @@ steps:
     image: alpine:3.22
     commands:
       - apk add -q --no-cache aws-cli
-      - aws s3 ls s3://devxy-r-builds/${PLATFORM_ID}/ | grep ${ARCH_ID} | tail -1 | awk '{print $NF}' | cut -c 3-7 > r_build_latest.txt
-      - cat r_build_latest.txt
+      - |
+          VERSION=$(cat r-version-to-build.txt)
+          aws s3 ls s3://devxy-r-builds/${PLATFORM_ID}/ | \
+            awk -v arch="${ARCH_ID}" -v ver="${VERSION}" \
+              '$0 ~ arch && $0 ~ ver {print substr($NF, 3, 5)}' > r-version-s3.txt
+      - cat r-version-s3.txt
     backend_options:
       kubernetes:
         nodeSelector:
@@ -149,10 +153,10 @@ steps:
       DOCKER_HOST: tcp://docker:2375
     commands: |
       # docker info
-      if [ ! -s r_build_latest.txt ] || [ ! "$(cat r-release-version.txt)" = "$(cat r_build_latest.txt)" ]; then
+      if ! grep -qF "$(cat r-version-to-build.txt)" r-version-s3.txt; then
         apk add -q --no-cache py3-pip make just aws-cli docker-compose
         pip3 install -q b2 --break-system-packages
-        just build-r-${PLATFORM} $(cat r-release-version.txt)
+        just build-r-${PLATFORM} $(cat r-version-to-build.txt)
       fi
     backend_options:
       kubernetes:
@@ -173,7 +177,7 @@ steps:
             effect: "NoSchedule"
 
   - name: Upload to Hetzner S3
-    image: woodpeckerci/plugin-s3:1.3.0
+    image: woodpeckerci/plugin-s3:1.5.0
     pull: true
     settings:
       bucket: devxy-r-builds
diff --git a/builder/Dockerfile.rhel-10 b/builder/Dockerfile.rhel-10
index 53da514..a44bf56 100644
--- a/builder/Dockerfile.rhel-10
+++ b/builder/Dockerfile.rhel-10
@@ -1,4 +1,4 @@
-FROM almalinux:10
+FROM rockylinux/rockylinux:10
 
 ENV OS_IDENTIFIER rhel-10
 
@@ -59,7 +59,9 @@ RUN curl -LO "https://github.com/goreleaser/nfpm/releases/download/v2.18.1/nfpm_
 
 RUN chmod 0777 /opt
 
-# Configure flags for RHEL 9 that don't use the defaults in build.sh
+# Configure flags for RHEL 10 that don't use the defaults in build.sh
+# Since RHEL 9 with the R 4.3.0 release, RHEL/Fedora now uses FlexiBLAS as the
+# default BLAS/LAPACK, which provides a native BLAS switching mechanism and matches EPEL.
 ENV CONFIGURE_OPTIONS="\
     --enable-R-shlib \
     --with-tcltk \
@@ -68,26 +70,25 @@ ENV CONFIGURE_OPTIONS="\
     --with-system-valgrind-headers \
     --with-tcl-config=/usr/lib64/tclConfig.sh \
     --with-tk-config=/usr/lib64/tkConfig.sh \
-    --enable-prebuilt-html"
+    --enable-prebuilt-html \
+    --with-blas=flexiblas \
+    --with-lapack=flexiblas"
 
-# RHEL 9 doesn't have the inconsolata font, so override the defaults.
+# RHEL 10 doesn't have the inconsolata font, so override the defaults.
 # This may be removed if RHEL ever adds the texlive-inconsolata package from Fedora.
 # Or check `dnf provides '*/inconsolata.sty'` for a package that provides it.
 # https://cran.r-project.org/doc/manuals/r-release/R-admin.html#Making-the-manuals
 ENV R_RD4PDF="times,hyper"
 
 # Make sure that patching Java does not break R.
-# R's default JAVA_HOME path includes the exact Java version on CentOS/RHEL, which
+# R's default JAVA_HOME path includes the exact Java version on RHEL, which
 # requires users to run `R CMD javareconf` even on minor/patch upgrades. Use the
 # major version symlink to avoid this.
 # https://cran.r-project.org/doc/manuals/r-release/R-admin.html#Java-support
 # https://solutions.posit.co/envs-pkgs/using-rjava/
-ENV JAVA_HOME=/usr/lib/jvm/jre-11-openjdk
+ENV JAVA_HOME=/usr/lib/jvm/jre-21-openjdk
 
-# R 3.x requires PCRE2 for Pango support on RHEL 9
-ENV INCLUDE_PCRE2_IN_R_3 yes
-
-COPY package.rhel-9 /package.sh
+COPY package.rhel-10 /package.sh
 COPY build.sh .
 COPY patches /patches
 ENTRYPOINT ./build.sh
diff --git a/builder/package.rhel-10 b/builder/package.rhel-10
index 1c3d03b..6c03c69 100644
--- a/builder/package.rhel-10
+++ b/builder/package.rhel-10
@@ -4,67 +4,22 @@ if [[ ! -d /tmp/output/${OS_IDENTIFIER} ]]; then
   mkdir -p "/tmp/output/${OS_IDENTIFIER}"
 fi
 
-# R 3.x requires PCRE1. On RHEL 9, R 3.x also requires PCRE2 for Pango support.
-pcre_libs='- pcre2-devel'
-if [[ "${R_VERSION}" =~ ^3 ]]; then
-  pcre_libs='- pcre2-devel
-- pcre-devel'
+# R 4.5.0 and later require libzstd (with headers to link against libR)
+zstd_libs='# - libzstd-devel'
+if grep -q '^LIBS *=.*[-]lzstd' ${R_INSTALL_PATH}/lib/R/etc/Makeconf; then
+    zstd_libs='- libzstd-devel'
 fi
 
-# On RHEL and SUSE, we link R against the internal shared BLAS to make the
-# R binaries more portable and allow users to switch BLAS implementations without
-# having to recompile R. We default to OpenBLAS, but users may prefer other implementations.
-# 
-# Binary packages built against the shared BLAS are also more portable and may be used
-# with the default R distributed by RHEL/SUSE, or other R installations using
-# shared BLAS and configured with a different BLAS (such as Microsoft R Open with MKL).
-# This is especially important for Posit Package Manager's binary packages.
-#
-# However, EPEL 9's R now links externally against FlexiBLAS, which provides a
-# native BLAS switching mechanism for Fedora/RHEL. Starting with R 4.3.0, we also
-# link to external FlexiBLAS for compatibility.
-# https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager
-#
-# On Ubuntu/Debian, we link R against the external BLAS instead (--with-blas/--with-lapack),
-# as those distributions use the alternatives system to swap BLAS libraries at runtime.
-# The default R distributions on Ubuntu/Debian use the external BLAS, so we do as well
-# for portability.
-#
-# https://cran.r-project.org/doc/manuals/r-release/R-admin.html#Shared-BLAS
-if [[ "$("${R_INSTALL_PATH}/bin/R" CMD config BLAS_LIBS)" == "-lflexiblas" ]]; then
-  blas_lib='flexiblas-devel'
-
-  # Create postremove script to remove empty directories, as nFPM doesn't include them in the RPM files.
-  cat <<EOF >> /after-remove.sh
-  if [ -d ${R_INSTALL_PATH} ]; then
-    rm -r ${R_INSTALL_PATH}
-  fi
-EOF
-
-  scripts="scripts:
-  postremove: /after-remove.sh
-"
-else
-  blas_lib='openblas-devel'
-
-  # Create post-install script required for OpenBLAS.
-  cat <<EOF >> /post-install.sh
-  mv ${R_INSTALL_PATH}/lib/R/lib/libRblas.so ${R_INSTALL_PATH}/lib/R/lib/libRblas.so.keep
-  ln -s /usr/lib64/libopenblasp.so ${R_INSTALL_PATH}/lib/R/lib/libRblas.so
-EOF
-
-  # Create after-remove script to remove internal BLAS, which won't be cleaned up automatically.
-  cat <<EOF >> /after-remove.sh
-  if [ -d ${R_INSTALL_PATH} ]; then
-    rm -r ${R_INSTALL_PATH}
-  fi
-EOF
-
-  scripts="scripts:
-  postinstall: /post-install.sh
-  postremove: /after-remove.sh
-"
+# Create postremove script to remove empty directories, as nFPM doesn't include them in the RPM files.
+cat <<EOF >> /after-remove.sh
+if [ -d ${R_INSTALL_PATH} ]; then
+  rm -r ${R_INSTALL_PATH}
 fi
+EOF
+
+scripts="scripts:
+  postremove: /after-remove.sh
+"
 
 if [ "$(arch)" == "aarch64" ]; then echo arm64; else echo amd64; fi > /tmp/arch
 
@@ -91,10 +46,11 @@ depends:
 - libtiff
 - libXmu
 - libXt
+${zstd_libs}
 - make
-- ${blas_lib}
+- flexiblas-devel
 - pango
-${pcre_libs}
+- pcre2-devel
 - tcl
 - tk
 - unzip
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..818223b
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,18 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>devxy/renovate-config"],
+  "automergeType": "branch",
+  "enabledManagers": ["woodpecker", "custom.regex"],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.crow(?:/[^/]+)?\\.ya?ml$/"],
+      "matchStrings": [
+        "(?<depName>\\w+):\\s*(?<currentValue>\\S+)\\s*#\\s*renovate:\\s*datasource=(?<datasource>\\S+)\\s*depName=(?<depName2>\\S+)"
+      ],
+      "datasourceTemplate": "{{{datasource}}}",
+      "depNameTemplate": "{{{depName2}}}",
+      "versioningTemplate": "semver"
+    }
+  ]
+}