diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index d5124e4..0d4f5ba 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -21,7 +21,7 @@ jobs:
             -e RENOVATE_PLATFORM=gitea \
             -e RENOVATE_REPOSITORIES=${{ github.repository }} \
             -e RENOVATE_TOKEN \
-            renovate/renovate:44.33.2
+            renovate/renovate:44.37.1
 
   # After the renovate job, cut ONE tag covering the renovate-bot commits merged to main since the
   # last tag (batch per run). Targets origin/main — the real post-merge tip; the checkout SHA is the
diff --git a/compose.override.yml b/compose.override.yml
index 2b9de80..dc31986 100644
--- a/compose.override.yml
+++ b/compose.override.yml
@@ -58,7 +58,7 @@ services:
   # Dev mail catcher — Kratos recovery/verification emails land here (web UI on 8025).
   # kratos.yml points the courier at smtp://mailpit:1025; prod uses a real SMTP via env.
   mailpit:
-    image: axllent/mailpit:v1.30.7
+    image: axllent/mailpit:v1.31.0
     ports:
       - "8025:8025"
     restart: unless-stopped