diff --git a/compose.tunnel.yml b/compose.tunnel.yml
index ad997c2..f5b6fc4 100644
--- a/compose.tunnel.yml
+++ b/compose.tunnel.yml
@@ -6,7 +6,7 @@
 # `tofu output -raw tunnel_token` yields CLOUDFLARE_TUNNEL_TOKEN for .env.
 services:
   cloudflared:
-    image: cloudflare/cloudflared:2026.9.3@sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c
+    image: cloudflare/cloudflared:2026.10.0@sha256:9b49eed8f62806d5d45ddf59ecefb5710429598ea6d3fcccd2af938f621b2b07
     restart: unless-stopped
     depends_on: [grafana, otel-collector]
     # Token via env, not --token: argv is readable from the host and from any
diff --git a/compose.yml b/compose.yml
index 4702b8e..07b3e83 100644
--- a/compose.yml
+++ b/compose.yml
@@ -58,7 +58,7 @@ services:
     logging: *default-logging
 
   otel-collector:
-    image: otel/opentelemetry-collector-contrib:0.161.0-386@sha256:76fd04f2d75922e93e447381bafcd0b78d24f1c5cdcc13f424d9a16f0342c087
+    image: otel/opentelemetry-collector-contrib:0.162.0@sha256:39923a8e431bd1f57be82411999d389fcfe40857492e4365456d97a4c1f74be6
     restart: unless-stopped
     depends_on:
       otel-queue-init: