diff --git a/services/cloudflare/docker-compose.yml b/services/cloudflare/docker-compose.yml
index 9c4692b3..f2e5e9f1 100644
--- a/services/cloudflare/docker-compose.yml
+++ b/services/cloudflare/docker-compose.yml
@@ -1,7 +1,7 @@
 x-sparkstack-enforce: ${SPARKSTACK_DIR:?SPARKSTACK_DIR must be set}
 services:
   tunnel:
-    image: cloudflare/cloudflared:2026.7.2
+    image: cloudflare/cloudflared:2026.8.2
     container_name: cloudflared
     restart: unless-stopped
     environment:
diff --git a/services/headscale/docker-compose.yml b/services/headscale/docker-compose.yml
index 9043811d..8a872015 100644
--- a/services/headscale/docker-compose.yml
+++ b/services/headscale/docker-compose.yml
@@ -12,7 +12,7 @@ volumes:
 services:
   headscale:
     container_name: sparkstack-headscale
-    image: headscale/headscale:v0.29.2
+    image: headscale/headscale:v0.29.3
     restart: unless-stopped
     command: serve
     networks:
diff --git a/services/monitoring/docker-compose.external.yml b/services/monitoring/docker-compose.external.yml
index 6b203a04..2cafb6a9 100644
--- a/services/monitoring/docker-compose.external.yml
+++ b/services/monitoring/docker-compose.external.yml
@@ -4,7 +4,7 @@
 x-sparkstack-enforce: ${SPARKSTACK_DIR:?SPARKSTACK_DIR must be set}
 services:
   alloy:
-    image: grafana/alloy:v1.18.0
+    image: grafana/alloy:v1.19.2
     container_name: alloy
     ports:
     - 12345:12345
diff --git a/services/monitoring/docker-compose.yml b/services/monitoring/docker-compose.yml
index 7eb153ee..4b6c1ea4 100644
--- a/services/monitoring/docker-compose.yml
+++ b/services/monitoring/docker-compose.yml
@@ -1,7 +1,7 @@
 x-sparkstack-enforce: ${SPARKSTACK_DIR:?SPARKSTACK_DIR must be set}
 services:
   prometheus:
-    image: quay.io/prometheus/prometheus:v3.13.1
+    image: quay.io/prometheus/prometheus:v3.14.0
     container_name: prometheus
     user: root
     ports:
@@ -31,7 +31,7 @@ services:
         limits:
           memory: 2G
   alloy:
-    image: grafana/alloy:v1.18.0
+    image: grafana/alloy:v1.19.2
     container_name: alloy
     ports:
     - 12345:12345
@@ -91,7 +91,7 @@ services:
       - monitoring
 
   grafana:
-    image: grafana/grafana:13.1.0
+    image: grafana/grafana:13.2.0
     container_name: grafana
     ports:
     - 3001:3000
@@ -155,7 +155,7 @@ services:
     - SPARKRUN_STATSD_HOST=alloy
 
   tempo:
-    image: grafana/tempo:3.0.2
+    image: grafana/tempo:3.0.3
     container_name: tempo
     user: root
     command: [ "-config.file=/etc/tempo.yaml" ]
diff --git a/services/openclaw/docker/Dockerfile.gateway-custom b/services/openclaw/docker/Dockerfile.gateway-custom
index 032aab6c..e89090b5 100644
--- a/services/openclaw/docker/Dockerfile.gateway-custom
+++ b/services/openclaw/docker/Dockerfile.gateway-custom
@@ -62,7 +62,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Install Go via multi-stage copy
-COPY --from=golang:1.26 /usr/local/go/ /usr/local/go/
+COPY --from=golang:1.27 /usr/local/go/ /usr/local/go/
 ENV PATH="/usr/local/go/bin:${PATH}"
 
 # Install uv globally
diff --git a/services/openclaw/docker/Dockerfile.sandbox-custom b/services/openclaw/docker/Dockerfile.sandbox-custom
index b7223b08..e445256c 100644
--- a/services/openclaw/docker/Dockerfile.sandbox-custom
+++ b/services/openclaw/docker/Dockerfile.sandbox-custom
@@ -59,7 +59,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Install Go via multi-stage copy
-COPY --from=golang:1.26 /usr/local/go/ /usr/local/go/
+COPY --from=golang:1.27 /usr/local/go/ /usr/local/go/
 
 # Install uv globally
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
diff --git a/services/openclaw/docker/package.json b/services/openclaw/docker/package.json
index a5b5aa47..5683cb27 100644
--- a/services/openclaw/docker/package.json
+++ b/services/openclaw/docker/package.json
@@ -3,9 +3,9 @@
   "version": "1.0.0",
   "private": true,
   "dependencies": {
-    "@google/gemini-cli": "0.51.0",
-    "@earendil-works/pi-coding-agent": "0.80.10",
-    "mcporter": "0.12.3",
-    "@steipete/summarize": "0.21.6"
+    "@google/gemini-cli": "0.57.0",
+    "@earendil-works/pi-coding-agent": "0.84.4",
+    "mcporter": "0.13.8",
+    "@steipete/summarize": "0.21.11"
   }
 }