diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 650bff24..89de1b3c 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -34,7 +34,8 @@
   "automerge": false,
   "postUpgradeTasks": {
     "commands": [
-      "tools/internal/refresh_lockfile_digests.py"
+      "tools/internal/refresh_lockfile_digests.py",
+      "tools/internal/sync_readme.py"
     ],
     "fileFilters": ["**/*"],
     "executionMode": "update"
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index ee945f3a..ff3e571b 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -48,10 +48,11 @@ jobs:
           configurationFile: .github/renovate.json5
         env:
           LOG_LEVEL: debug
-          # Allow the post-upgrade task that refreshes lockfile URLs and sha256
-          # digests (allowedCommands is a global-only option, so it must be set
-          # here rather than in renovate.json5).
-          RENOVATE_ALLOWED_COMMANDS: '["tools/internal/refresh_lockfile_digests.py"]'
+          # Allow the post-upgrade tasks that refresh lockfile URLs and sha256
+          # digests and re-sync the generated tool table in tools/README.md
+          # (allowedCommands is a global-only option, so it must be set here
+          # rather than in renovate.json5).
+          RENOVATE_ALLOWED_COMMANDS: '["tools/internal/refresh_lockfile_digests.py", "tools/internal/sync_readme.py"]'
   validate-renovate-config:
     name: Validate Renovate config
     runs-on: ubuntu-latest
diff --git a/tools/internal/sync_readme.py b/tools/internal/sync_readme.py
old mode 100644
new mode 100755
index e98f6813..13854743
--- a/tools/internal/sync_readme.py
+++ b/tools/internal/sync_readme.py
@@ -1,3 +1,4 @@
+#!/usr/bin/env python3
 # *******************************************************************************
 # Copyright (c) 2026 Contributors to the Eclipse Foundation
 #