diff --git a/docker/docker-compose.dev.yaml b/docker/docker-compose.dev.yaml
index 21693195..4095bd82 100644
--- a/docker/docker-compose.dev.yaml
+++ b/docker/docker-compose.dev.yaml
@@ -154,7 +154,7 @@ services:
         max-file: "3"
   mailpit:
     container_name: mailpit
-    image: axllent/mailpit:v1.31.1
+    image: axllent/mailpit:v1.31.3
     environment:
       - MP_QUIET=true
     restart: unless-stopped
@@ -184,7 +184,7 @@ services:
         max-file: "3"
   changedetection:
     container_name: changedetection
-    image: dgtlmoon/changedetection.io:0.60.4
+    image: dgtlmoon/changedetection.io:0.60.8
     volumes:
       - changedetection_data:/datastore
     environment:
@@ -218,7 +218,7 @@ services:
       - MAX_CONCURRENT_CHROME_PROCESSES=10
       - LOG_LEVEL=WARNING
   grafana:
-    image: grafana/grafana:13.2.1
+    image: grafana/grafana:13.2.2
     container_name: grafana
     ports:
       - "8083:3000"
diff --git a/docker/prod/docker-compose.local.yaml b/docker/prod/docker-compose.local.yaml
index d350af76..292822d6 100644
--- a/docker/prod/docker-compose.local.yaml
+++ b/docker/prod/docker-compose.local.yaml
@@ -21,7 +21,7 @@ services:
         condition: service_started
 
   mailpit:
-    image: axllent/mailpit:v1.31.1
+    image: axllent/mailpit:v1.31.3
     environment:
       - MP_QUIET=true
     ports:
diff --git a/e2e/docker-compose.dev.yaml b/e2e/docker-compose.dev.yaml
index 4393e1a5..e04d842b 100644
--- a/e2e/docker-compose.dev.yaml
+++ b/e2e/docker-compose.dev.yaml
@@ -143,7 +143,7 @@ services:
   # the tests read verification links out of mailpit's REST API, so its
   # http port is published rather than proxied through caddy.
   mailpit:
-    image: axllent/mailpit:v1.31.1
+    image: axllent/mailpit:v1.31.3
     environment:
       - MP_QUIET=true
     ports:
diff --git a/e2e/docker-compose.prod.yaml b/e2e/docker-compose.prod.yaml
index 60a4962c..4cdfa002 100644
--- a/e2e/docker-compose.prod.yaml
+++ b/e2e/docker-compose.prod.yaml
@@ -98,7 +98,7 @@ services:
   # ports are not published, so every such probe would pass whether the
   # services bound loopback or the wildcard.
   probe:
-    image: alpine:3.24.1
+    image: alpine:3.24.2
     command: ["sleep", "infinity"]
     depends_on:
       oxynote:
@@ -108,7 +108,7 @@ services:
   # port is published rather than proxied through the image's front door —
   # which routes nothing but the product.
   mailpit:
-    image: axllent/mailpit:v1.31.1
+    image: axllent/mailpit:v1.31.3
     environment:
       - MP_QUIET=true
     ports: