diff --git a/compose.tunnel.yml b/compose.tunnel.yml
index 1b07b8c..74b3040 100644
--- a/compose.tunnel.yml
+++ b/compose.tunnel.yml
@@ -6,7 +6,7 @@
 # `tofu output -raw tunnel_token` yields CLOUDFLARE_TUNNEL_TOKEN for .env.
 services:
   cloudflared:
-    image: cloudflare/cloudflared:2026.8.3@sha256:51c9cefcb4569df44e1ad403ab1d3d8065aa8e84339bcfc6aee75502e1140339
+    image: cloudflare/cloudflared:2026.9.1@sha256:b269e8abd07a5bf6f3f4be65d5050b2174eca89c56a0241a8ff32a16aec454e4
     restart: unless-stopped
     depends_on: [grafana, otel-collector]
     # Token via env, not --token: argv is readable from the host and from any
diff --git a/compose.yml b/compose.yml
index df783e0..cca9b7f 100644
--- a/compose.yml
+++ b/compose.yml
@@ -58,7 +58,7 @@ services:
     logging: *default-logging
 
   otel-collector:
-    image: otel/opentelemetry-collector-contrib:0.160.0@sha256:799dc6cf12c96192af37b5bdba804da8c10b3bc563b43cb90c3f3c58d9572ad6
+    image: otel/opentelemetry-collector-contrib:0.161.0@sha256:fd328de2552466ad78385e1b1289c3f2402b1c45f265b252aab1955b42845ac1
     restart: unless-stopped
     depends_on:
       otel-queue-init:
@@ -87,7 +87,7 @@ services:
     networks: [default, backend]
 
   loki:
-    image: grafana/loki:3.7.7@sha256:d70e4659623f3e109af669cae76fe2a5dd5be54e2298fe8aed380d982fbc2500
+    image: grafana/loki:3.7.8@sha256:1107dd5274e0ada47e42472b7a7e71f3b2a2fe878878108f3e2f9e51528f0193
     restart: unless-stopped
     volumes:
       - ./config/loki.yaml:/etc/loki/loki.yaml:ro
@@ -163,7 +163,7 @@ services:
     networks: [backend]
 
   grafana:
-    image: grafana/grafana:13.2.1@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283
+    image: grafana/grafana:13.2.2@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0
     restart: unless-stopped
     depends_on:
       loki: