diff --git a/tunnel/compose.yaml b/tunnel/compose.yaml
index 6ab2bed..29c6718 100644
--- a/tunnel/compose.yaml
+++ b/tunnel/compose.yaml
@@ -5,7 +5,7 @@
 # The image is pinned by tag and digest. To upgrade, change both and run `docker compose up -d` again.
 services:
   cloudflared:
-    image: cloudflare/cloudflared:2026.10.5@sha256:1b1d34d0a9c0bfca9de72db8460d328db3f19edd2b96169114e3e893a97bbe53
+    image: cloudflare/cloudflared:2026.10.7@sha256:4955524aeaa379e154023d5a027c250f7b35041a2e7e950cf13f144bc9b9c5ba
     # The host user, not the image's 65532: a file secret keeps the host file's owner and mode,
     # and the token file is 600.
     user: ${CMLOPS_UID:?set CMLOPS_UID in .env (id -u)}:${CMLOPS_GID:?set CMLOPS_GID in .env (id -g)}