diff --git a/stacks/observability/compose.yaml b/stacks/observability/compose.yaml
index a68fdd60..57b0d597 100644
--- a/stacks/observability/compose.yaml
+++ b/stacks/observability/compose.yaml
@@ -391,7 +391,7 @@ services:
   # ---------------------------------------------------------------------------
   loki:
     <<: *service-defaults
-    image: grafana/loki:3.7.8@sha256:1107dd5274e0ada47e42472b7a7e71f3b2a2fe878878108f3e2f9e51528f0193
+    image: grafana/loki:3.7.9@sha256:0db216b630ae1f348a1584c67f3cead8b4c1fc839169a39501db664744158e28
     container_name: loki
     user: "10001:10001"
     # 1.5x the 1015 MiB peak — the tightest ratio and the largest number, which
@@ -1079,7 +1079,7 @@ services:
     # record for `prometheus` aimed at this container, and remote_write started
     # dialling Alloy instead of Prometheus. config.alloy reads ALLOY_HOSTNAME
     # from the environment instead; the header of that file has the whole story.
-    image: grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
+    image: grafana/alloy:v1.21.1@sha256:4039c971193053a84e53dd9ed3e7d4561c069256b024631cd3498a353ed7ece8
     container_name: alloy
     # 1024 rather than the shared 512: this is the one service that walks
     # cgroups, tails the journal and talks to the Docker socket, so it has more
@@ -1329,7 +1329,7 @@ services:
     # reports its error to capture-screenshots.sh.
     labels:
       homelab.logs: "off"
-    image: grafana/grafana-image-renderer:v5.12.7@sha256:a643fd3ee669ff1b6927d5589c37ee1078b52fc76cea9a7bf8e247357e9d9dd1
+    image: grafana/grafana-image-renderer:v5.12.8@sha256:0c848c981e4733fc7a9336b7e8fb5d412c461c8e9ee62d11e39d4f3eb8b66834
     container_name: renderer
     environment:
       # The renderer loads the dashboard in a headless Chromium, and Chromium