diff --git a/.github/workflows/ops-ci.yml b/.github/workflows/ops-ci.yml
index c4de891..0b959bd 100644
--- a/.github/workflows/ops-ci.yml
+++ b/.github/workflows/ops-ci.yml
@@ -27,7 +27,7 @@ jobs:
         run: npx --yes prettier --check "**/*.{yaml,yml,md,json}"
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@v4
         with:
           terraform_wrapper: false
 
diff --git a/README.md b/README.md
index 21591e6..6e466fe 100644
--- a/README.md
+++ b/README.md
@@ -44,8 +44,10 @@ cloud showcase** — it must never be a prerequisite to run or grade the product
 
 > Status: this repo is derived from a **proven reference deployment** (a working
 > DOKS + Traefik + Postgres/Redis stack). The reusable infrastructure manifests
-> are in place; the OpsWarden application services are **placeholders** until
-> their images are published. See the per-service status below.
+> are in place — their images modernized (Postgres 18 / Redis 8 / Traefik v3),
+> pending re-validation on a live cluster — while the OpsWarden application
+> services are **placeholders** until their images are published. Full re-targeting
+> once the core + AI SRE are deployable. See the per-service status below.
 
 ---
 
@@ -76,16 +78,16 @@ opswarden-ops/
 
 ## Services
 
-| Service           |                                       Tech                                       | Status                                      |
-| ----------------- | :------------------------------------------------------------------------------: | ------------------------------------------- |
-| **server**        |    <img src="https://skillicons.dev/icons?i=rust" height="22" /> Rust / Axum     | placeholder — `k8s/server/`                 |
-| **client-web**    |     <img src="https://skillicons.dev/icons?i=nextjs" height="22" /> Next.js      | placeholder — `k8s/client-web/` (or Vercel) |
-| **investigation** | <img src="https://skillicons.dev/icons?i=python" height="22" /> FastAPI (AI SRE) | placeholder — `k8s/investigation/`          |
-| **worker**        |                                      async                                       | placeholder — `k8s/worker/`                 |
-| **PostgreSQL**    | <img src="https://skillicons.dev/icons?i=postgres" height="22" /> `postgres:13`  | ready — `k8s/postgres/`                     |
-| **Redis**         |    <img src="https://skillicons.dev/icons?i=redis" height="22" /> `redis:5.0`    | ready — `k8s/redis/`                        |
-| **Traefik**       |                                  `traefik:2.7`                                   | ready — `k8s/traefik/`                      |
-| **cAdvisor**      |  <img src="https://skillicons.dev/icons?i=prometheus" height="22" /> monitoring  | ready — `k8s/observability/`                |
+| Service           |                                          Tech                                          | Status                                      |
+| ----------------- | :------------------------------------------------------------------------------------: | ------------------------------------------- |
+| **server**        |       <img src="https://skillicons.dev/icons?i=rust" height="22" /> Rust / Axum        | placeholder — `k8s/server/`                 |
+| **client-web**    |        <img src="https://skillicons.dev/icons?i=nextjs" height="22" /> Next.js         | placeholder — `k8s/client-web/` (or Vercel) |
+| **investigation** |    <img src="https://skillicons.dev/icons?i=python" height="22" /> FastAPI (AI SRE)    | placeholder — `k8s/investigation/`          |
+| **worker**        |                                         async                                          | placeholder — `k8s/worker/`                 |
+| **PostgreSQL**    | <img src="https://skillicons.dev/icons?i=postgres" height="22" /> `postgres:18-alpine` | ready — `k8s/postgres/`                     |
+| **Redis**         |    <img src="https://skillicons.dev/icons?i=redis" height="22" /> `redis:8-alpine`     | ready — `k8s/redis/`                        |
+| **Traefik**       |                                     `traefik:v3.7`                                     | ready — `k8s/traefik/`                      |
+| **cAdvisor**      |     <img src="https://skillicons.dev/icons?i=prometheus" height="22" /> monitoring     | ready — `k8s/observability/`                |
 
 Replicated services use **pod anti-affinity** to land on different nodes.
 Shared config lives in **ConfigMaps**; credentials in **Secrets** (rotate the
diff --git a/k8s/postgres/postgres.deployment.yaml b/k8s/postgres/postgres.deployment.yaml
index 46e3ac9..874319a 100644
--- a/k8s/postgres/postgres.deployment.yaml
+++ b/k8s/postgres/postgres.deployment.yaml
@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: postgres
-          image: postgres:13
+          image: postgres:18-alpine
           ports:
             - containerPort: 5432
           env:
diff --git a/k8s/redis/redis.deployment.yaml b/k8s/redis/redis.deployment.yaml
index e139cc5..0ee410c 100644
--- a/k8s/redis/redis.deployment.yaml
+++ b/k8s/redis/redis.deployment.yaml
@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:5.0
+          image: redis:8-alpine
           ports:
             - containerPort: 6379
       restartPolicy: Always
diff --git a/k8s/traefik/traefik.deployment.yaml b/k8s/traefik/traefik.deployment.yaml
index b20a803..4a317b8 100644
--- a/k8s/traefik/traefik.deployment.yaml
+++ b/k8s/traefik/traefik.deployment.yaml
@@ -33,7 +33,10 @@ spec:
               topologyKey: "kubernetes.io/hostname"
       containers:
         - name: traefik
-          image: traefik:2.7
+          # Traefik v3 — the CLI flags below (api.insecure, kubernetesingress,
+          # entrypoints) are v2/v3-stable; re-validate on a live cluster when the
+          # app-service manifests stop being placeholders.
+          image: traefik:v3.7
           args:
             - --api.insecure=true
             - --providers.kubernetesingress=true