diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index bd8b303..5c6570b 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -21,7 +21,7 @@ jobs:
             -e RENOVATE_PLATFORM=gitea \
             -e RENOVATE_REPOSITORIES=${{ github.repository }} \
             -e RENOVATE_TOKEN \
-            renovate/renovate:44.11.7
+            renovate/renovate:44.31.0
 
   # After the renovate job, cut ONE tag covering the renovate-bot commits merged to main since the
   # last tag (batch per run). Targets origin/main — the real post-merge tip; the checkout SHA is the
diff --git a/compose.override.yml b/compose.override.yml
index 29db789..f4d0176 100644
--- a/compose.override.yml
+++ b/compose.override.yml
@@ -46,7 +46,7 @@ services:
   # Dev mail catcher — Kratos recovery/verification emails land here (web UI on 8025).
   # kratos.yml points the courier at smtp://mailpit:1025; prod uses a real SMTP via env.
   mailpit:
-    image: axllent/mailpit:v1.30.6
+    image: axllent/mailpit:v1.30.7
     ports:
       - "8025:8025"
     restart: unless-stopped
diff --git a/compose.yml b/compose.yml
index bc24df4..959745f 100644
--- a/compose.yml
+++ b/compose.yml
@@ -40,7 +40,7 @@ services:
   # init/init.sql creates one database per service. Dev defaults below; supply
   # POSTGRES_USER/PASSWORD via env in production.
   postgres:
-    image: postgres:18.4-alpine3.23
+    image: postgres:18.6-alpine3.23
     environment:
       POSTGRES_USER: ${POSTGRES_USER:-ory}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ory}
diff --git a/package-lock.json b/package-lock.json
index 07412c7..c7a90d5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,7 @@
       "dependencies": {
         "@larvit/log": "2.3.0",
         "ejs": "6.0.1",
-        "lucide-static": "1.28.0"
+        "lucide-static": "1.31.0"
       },
       "devDependencies": {
         "@types/ejs": "3.1.5",
@@ -400,9 +400,9 @@
       }
     },
     "node_modules/lucide-static": {
-      "version": "1.28.0",
-      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.28.0.tgz",
-      "integrity": "sha512-dC3VJwRFsjEVX7Iaq4rY88pm7Fi2OmOb8P0WRzXsUMgbt7sCmFX8bLhaDBeNW6JdRjuele+jKqqFaam4yr+Ygg==",
+      "version": "1.31.0",
+      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.31.0.tgz",
+      "integrity": "sha512-XFX9NO+gcLsOkXISmeQZYGJa2siGWZc/lgT/BK1b83h9RdOiz3cj1eQP5nWhELiB1KhW5ryk0nmMopOgm/CuSA==",
       "license": "ISC"
     },
     "node_modules/typescript": {
diff --git a/package.json b/package.json
index 51feac6..81b53d2 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
   "dependencies": {
     "@larvit/log": "2.3.0",
     "ejs": "6.0.1",
-    "lucide-static": "1.28.0"
+    "lucide-static": "1.31.0"
   },
   "devDependencies": {
     "@types/ejs": "3.1.5",