diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index cc0103f11..bfa873c78 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -56,8 +56,8 @@ jobs:
         run: pnpm exec playwright install --with-deps
       - name: Run backend components
         run: |
-          docker compose -f playwright-backend-docker-compose.yml -f playwright-backend-docker-compose.override.yml pull
-          docker compose -f playwright-backend-docker-compose.yml -f playwright-backend-docker-compose.override.yml up -d
+          docker compose -f docker-compose-dev.yml -f docker-compose-playwright.yml pull
+          docker compose -f docker-compose-dev.yml -f docker-compose-playwright.yml up -d
           docker ps
       - name: Run Playwright tests
         env:
diff --git a/README.md b/README.md
index 7d11af061..546e491a1 100644
--- a/README.md
+++ b/README.md
@@ -212,7 +212,7 @@ See also:
 
 ### Backend
 
-A docker compose file `dev-backend-docker-compose.yml` is provided to start the
+A docker compose file `docker-compose-dev.yml` is provided to start the
 whole stack of components which is required for a local development environment
 including federation:
 
@@ -239,7 +239,7 @@ the backend components:
 ```sh
 pnpm backend
 # or for podman-compose:
-# podman-compose -f dev-backend-docker-compose.yml up
+# podman-compose -f docker-compose-dev.yml up
 ```
 
 > [!NOTE]
diff --git a/dev-backend-docker-compose.yml b/docker-compose-dev.yml
similarity index 98%
rename from dev-backend-docker-compose.yml
rename to docker-compose-dev.yml
index 702aef395..25883b4f0 100644
--- a/dev-backend-docker-compose.yml
+++ b/docker-compose-dev.yml
@@ -156,7 +156,7 @@ services:
   nginx:
     #  see backend/dev_tls_setup for how to generate the tls certs
     hostname: synapse.m.localhost
-    image: nginx:latest
+    image: nginx:latest@sha256:4ae259ae64fbedb67918c07d167fdcb0e05855a1615480ca445bea485e7d65ff
     pull_policy: always
     volumes:
       - ./backend/dev_nginx.conf:/etc/nginx/conf.d/default.conf:Z
diff --git a/docker-compose-playwright.yml b/docker-compose-playwright.yml
new file mode 100644
index 000000000..d517a4a93
--- /dev/null
+++ b/docker-compose-playwright.yml
@@ -0,0 +1,19 @@
+# This file contains overrides to docker-compose-dev.yml and should
+# only be used in combination with that file.
+services:
+  synapse:
+    # Pin to a SHA so that upstream cannot break our tests. Renovate handles regular updates.
+    image: ghcr.io/element-hq/synapse:latest@sha256:da325af40104051923899e5f5a2f1d537e6e3ccf2f0f38285689ae9bbfdb190a
+    volumes:
+      - ./backend/playwright_homeserver.yaml:/data/cfg/homeserver.yaml:Z
+  synapse-1:
+    # Pin to a SHA so that upstream cannot break our tests. Renovate handles regular updates.
+    image: ghcr.io/element-hq/synapse:latest@sha256:da325af40104051923899e5f5a2f1d537e6e3ccf2f0f38285689ae9bbfdb190a
+    volumes:
+      - ./backend/playwright_homeserver-othersite.yaml:/data/cfg/homeserver.yaml:Z
+  element-web:
+    # Pin to a SHA so that upstream cannot break our tests. Renovate handles regular updates.
+    image: ghcr.io/element-hq/element-web:develop@sha256:365eca844f0782676f2406e5107e2f74fae2ecdb1725cc42060a91681aeee4c4
+  element-web-1:
+    # Pin to a SHA so that upstream cannot break our tests. Renovate handles regular updates.
+    image: ghcr.io/element-hq/element-web:develop@sha256:365eca844f0782676f2406e5107e2f74fae2ecdb1725cc42060a91681aeee4c4
diff --git a/package.json b/package.json
index fda2ef0db..b63acd348 100644
--- a/package.json
+++ b/package.json
@@ -30,8 +30,8 @@
     "test:storybook": "vitest --project=storybook",
     "test:unit": "vitest --project=unit",
     "test:coverage": "vitest --coverage",
-    "backend": "docker-compose -f dev-backend-docker-compose.yml up",
-    "backend-playwright": "docker-compose -f playwright-backend-docker-compose.yml -f playwright-backend-docker-compose.override.yml up",
+    "backend": "docker-compose -f docker-compose-dev.yml up",
+    "backend-playwright": "docker-compose -f docker-compose-dev.yml -f docker-compose-playwright.yml up",
     "test:playwright": "playwright test",
     "test:playwright:open": "pnpm test:playwright --ui",
     "links:on": "cp scripts/.pnpmfile.cjs .pnpmfile.cjs & pnpm install",
diff --git a/playwright-backend-docker-compose.override.yml b/playwright-backend-docker-compose.override.yml
deleted file mode 100644
index 8648c63c2..000000000
--- a/playwright-backend-docker-compose.override.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-services:
-  synapse:
-    volumes:
-      - ./backend/playwright_homeserver.yaml:/data/cfg/homeserver.yaml:Z
-  synapse-1:
-    volumes:
-      - ./backend/playwright_homeserver-othersite.yaml:/data/cfg/homeserver.yaml:Z
diff --git a/playwright-backend-docker-compose.yml b/playwright-backend-docker-compose.yml
deleted file mode 100644
index bb6686d04..000000000
--- a/playwright-backend-docker-compose.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-include:
-  - dev-backend-docker-compose.yml
diff --git a/renovate.json b/renovate.json
index 880683ea9..56e7ac8f8 100644
--- a/renovate.json
+++ b/renovate.json
@@ -61,6 +61,15 @@
     {
       "groupName": "Pnpm",
       "matchDepNames": ["pnpm"]
+    },
+    {
+      "description": "Update the element-web image digest daily, in its own PR",
+      "groupName": "Element Web",
+      "matchPackageNames": ["ghcr.io/element-hq/element-web"],
+      "matchUpdateTypes": ["digest"],
+      "schedule": ["* 0-3 * * *"],
+      "minimumReleaseAge": null,
+      "automerge": true
     }
   ],
   "semanticCommits": "disabled",