diff --git a/docker-compose.test.yml b/docker-compose.test.yml
index 380f6fb..1f526d8 100644
--- a/docker-compose.test.yml
+++ b/docker-compose.test.yml
@@ -106,7 +106,7 @@ services:
 
   alloy:
     profiles: ["observability"]
-    image: grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
+    image: grafana/alloy:v1.21.0@sha256:9726bfba078de9bc2212c60c6e643238c700b4fe0868ea78cbe03163d03d95bf
     command:
       - run
       - --server.http.listen-addr=0.0.0.0:12345
@@ -129,7 +129,7 @@ services:
 
   prometheus:
     profiles: ["observability"]
-    image: prom/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
+    image: prom/prometheus:v3.15.1@sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2
     command:
       - --config.file=/etc/prometheus/prometheus.yml
       - --storage.tsdb.path=/prometheus
@@ -147,7 +147,7 @@ services:
 
   loki:
     profiles: ["observability"]
-    image: grafana/loki:3.7.8@sha256:1107dd5274e0ada47e42472b7a7e71f3b2a2fe878878108f3e2f9e51528f0193
+    image: grafana/loki:3.7.9@sha256:0db216b630ae1f348a1584c67f3cead8b4c1fc839169a39501db664744158e28
     command: ["-config.file=/etc/loki/loki-config.yml"]
     volumes:
       - ./services/observability/loki/loki-config.yml:/etc/loki/loki-config.yml:ro
@@ -171,7 +171,7 @@ services:
 
   grafana:
     profiles: ["observability"]
-    image: grafana/grafana:13.2.3@sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572
+    image: grafana/grafana:13.2.4@sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f
     environment:
       - GF_AUTH_ANONYMOUS_ENABLED=true
       - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
diff --git a/docker-compose.yml b/docker-compose.yml
index 3356a69..0abe99b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -272,7 +272,7 @@ services:
 
   # Alloy + LGTM (always on). Optional Let's Encrypt: --profile letsencrypt
   alloy:
-    image: grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
+    image: grafana/alloy:v1.21.0@sha256:9726bfba078de9bc2212c60c6e643238c700b4fe0868ea78cbe03163d03d95bf
     command:
       - run
       - --server.http.listen-addr=0.0.0.0:12345
@@ -307,7 +307,7 @@ services:
       - tempo
 
   prometheus:
-    image: prom/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
+    image: prom/prometheus:v3.15.1@sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2
     command:
       - --config.file=/etc/prometheus/prometheus.yml
       - --storage.tsdb.path=/prometheus
@@ -325,7 +325,7 @@ services:
     restart: unless-stopped
 
   loki:
-    image: grafana/loki:3.7.8@sha256:1107dd5274e0ada47e42472b7a7e71f3b2a2fe878878108f3e2f9e51528f0193
+    image: grafana/loki:3.7.9@sha256:0db216b630ae1f348a1584c67f3cead8b4c1fc839169a39501db664744158e28
     command: ["-config.file=/etc/loki/loki-config.yml"]
     volumes:
       - ./services/observability/loki/loki-config.yml:/etc/loki/loki-config.yml:ro
@@ -349,7 +349,7 @@ services:
     restart: unless-stopped
 
   grafana:
-    image: grafana/grafana:13.2.3@sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572
+    image: grafana/grafana:13.2.4@sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f
     environment:
       - GF_AUTH_ANONYMOUS_ENABLED=true
       - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
diff --git a/services/observability/alloy.Dockerfile b/services/observability/alloy.Dockerfile
index 7cde677..7acd626 100644
--- a/services/observability/alloy.Dockerfile
+++ b/services/observability/alloy.Dockerfile
@@ -1,4 +1,4 @@
-FROM grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
+FROM grafana/alloy:v1.21.0@sha256:9726bfba078de9bc2212c60c6e643238c700b4fe0868ea78cbe03163d03d95bf
 
 # Named-volume WAL is often root-owned (git compose runs upstream Alloy as
 # root). Stay root for COPY + entrypoint chown, then drop to uid 473.
diff --git a/services/observability/grafana.Dockerfile b/services/observability/grafana.Dockerfile
index 4b4444e..a6ec6b3 100644
--- a/services/observability/grafana.Dockerfile
+++ b/services/observability/grafana.Dockerfile
@@ -1,4 +1,4 @@
-FROM grafana/grafana:13.2.3@sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572
+FROM grafana/grafana:13.2.4@sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f
 
 USER root
 COPY grafana/provisioning /etc/grafana/provisioning
diff --git a/services/observability/loki.Dockerfile b/services/observability/loki.Dockerfile
index 4a26638..6bf0ed6 100644
--- a/services/observability/loki.Dockerfile
+++ b/services/observability/loki.Dockerfile
@@ -1,4 +1,4 @@
-FROM grafana/loki:3.7.8@sha256:1107dd5274e0ada47e42472b7a7e71f3b2a2fe878878108f3e2f9e51528f0193
+FROM grafana/loki:3.7.9@sha256:0db216b630ae1f348a1584c67f3cead8b4c1fc839169a39501db664744158e28
 
 USER root
 COPY loki/loki-config.yml /etc/loki/loki-config.yml
diff --git a/services/observability/prometheus.Dockerfile b/services/observability/prometheus.Dockerfile
index 400b9f4..a27b125 100644
--- a/services/observability/prometheus.Dockerfile
+++ b/services/observability/prometheus.Dockerfile
@@ -1,4 +1,4 @@
-FROM prom/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
+FROM prom/prometheus:v3.15.1@sha256:fa3302279710be2f21a8301ec17a8b4f2301fd829bd113839b3b6b02b6f191a2
 
 USER root
 COPY prometheus/prometheus.yml /etc/prometheus/prometheus.yml