diff --git a/compose.tunnel.yml b/compose.tunnel.yml
index fa3934d..1b07b8c 100644
--- a/compose.tunnel.yml
+++ b/compose.tunnel.yml
@@ -6,7 +6,7 @@
 # `tofu output -raw tunnel_token` yields CLOUDFLARE_TUNNEL_TOKEN for .env.
 services:
   cloudflared:
-    image: cloudflare/cloudflared:2026.8.2@sha256:0aa26e284f05e6c77ae375b8c9c11d9eb6a448fb7bcd8d40f31cb6176189eb38
+    image: cloudflare/cloudflared:2026.8.3@sha256:51c9cefcb4569df44e1ad403ab1d3d8065aa8e84339bcfc6aee75502e1140339
     restart: unless-stopped
     depends_on: [grafana, otel-collector]
     # Token via env, not --token: argv is readable from the host and from any
diff --git a/compose.yml b/compose.yml
index f9a1cff..c47d3b1 100644
--- a/compose.yml
+++ b/compose.yml
@@ -87,7 +87,7 @@ services:
     networks: [default, backend]
 
   loki:
-    image: grafana/loki:3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952
+    image: grafana/loki:3.7.7@sha256:d70e4659623f3e109af669cae76fe2a5dd5be54e2298fe8aed380d982fbc2500
     restart: unless-stopped
     volumes:
       - ./config/loki.yaml:/etc/loki/loki.yaml:ro