diff --git a/runbooks/serving/deployment.yaml b/runbooks/serving/deployment.yaml
index bf8c0d5..cc43286 100644
--- a/runbooks/serving/deployment.yaml
+++ b/runbooks/serving/deployment.yaml
@@ -87,7 +87,7 @@ spec:
           # Renovate maintains this pin. nginx-unprivileged (not nginx) so the container can honour
           # runAsNonRoot: the stock nginx image's entrypoint needs root to drop privileges and to
           # bind :80. `stable-alpine` branch, pinned exactly.
-          image: nginxinc/nginx-unprivileged:1.30.4-alpine
+          image: nginxinc/nginx-unprivileged:1.31.7-alpine
           imagePullPolicy: IfNotPresent
           ports:
             - name: http