diff --git a/compose.demo.yml b/compose.demo.yml
index 2ce0fd9..390a020 100644
--- a/compose.demo.yml
+++ b/compose.demo.yml
@@ -31,7 +31,7 @@ services:
     logging: *demo-logging
 
   demo-load:
-    image: curlimages/curl:8.21.0@sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13
+    image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777
     restart: on-failure
     depends_on: [demo-api]
     command:
diff --git a/compose.tunnel.yml b/compose.tunnel.yml
index fa3934d..1b07b8c 100644
--- a/compose.tunnel.yml
+++ b/compose.tunnel.yml
@@ -6,7 +6,7 @@
 # `tofu output -raw tunnel_token` yields CLOUDFLARE_TUNNEL_TOKEN for .env.
 services:
   cloudflared:
-    image: cloudflare/cloudflared:2026.8.2@sha256:0aa26e284f05e6c77ae375b8c9c11d9eb6a448fb7bcd8d40f31cb6176189eb38
+    image: cloudflare/cloudflared:2026.8.3@sha256:51c9cefcb4569df44e1ad403ab1d3d8065aa8e84339bcfc6aee75502e1140339
     restart: unless-stopped
     depends_on: [grafana, otel-collector]
     # Token via env, not --token: argv is readable from the host and from any
diff --git a/compose.yml b/compose.yml
index f9a1cff..df783e0 100644
--- a/compose.yml
+++ b/compose.yml
@@ -58,7 +58,7 @@ services:
     logging: *default-logging
 
   otel-collector:
-    image: otel/opentelemetry-collector-contrib:0.156.0@sha256:125bdbeb7590cc1952c5b3430ecf14063568980c2c93d5b38676cc0446ed8108
+    image: otel/opentelemetry-collector-contrib:0.160.0@sha256:799dc6cf12c96192af37b5bdba804da8c10b3bc563b43cb90c3f3c58d9572ad6
     restart: unless-stopped
     depends_on:
       otel-queue-init:
@@ -87,7 +87,7 @@ services:
     networks: [default, backend]
 
   loki:
-    image: grafana/loki:3.7.6@sha256:efd47c67f9bac88ca29bcf8cb997d9ab29d1848bd0aff579282295542a745952
+    image: grafana/loki:3.7.7@sha256:d70e4659623f3e109af669cae76fe2a5dd5be54e2298fe8aed380d982fbc2500
     restart: unless-stopped
     volumes:
       - ./config/loki.yaml:/etc/loki/loki.yaml:ro
@@ -111,7 +111,7 @@ services:
     networks: [backend]
 
   prometheus:
-    image: prom/prometheus:v3.13.2@sha256:508729e0e2d18e11fd742a5a5ca70e557b940a93948c3c95fd0123a6fd538b69
+    image: prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0
     restart: unless-stopped
     volumes:
       - ./config/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
@@ -163,7 +163,7 @@ services:
     networks: [backend]
 
   grafana:
-    image: grafana/grafana:13.1.4@sha256:9be3a3ccdb06bcbb127f888b0c4c1d151837443e478887897a63a27d7b348043
+    image: grafana/grafana:13.2.1@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283
     restart: unless-stopped
     depends_on:
       loki: