diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index fa89d9f..41ccfa4 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -33,7 +33,7 @@ jobs:
       - name: Validate Alloy config syntax
         run: |
           docker run --rm -v "$PWD/config.alloy:/config.alloy:ro" \
-            grafana/alloy:v1.10.0 fmt /config.alloy > /dev/null
+            grafana/alloy:v1.16.1 fmt /config.alloy > /dev/null
 
       - name: Validate Alloy config semantics (parse + load components)
         # `fmt` is syntax-only; this catches bad component refs, wrong arg
@@ -54,7 +54,7 @@ jobs:
             -v /var/lib/docker:/var/lib/docker:ro \
             -v /tmp/empty-journal:/var/log/journal:ro \
             -v /etc/machine-id:/etc/machine-id:ro \
-            grafana/alloy:v1.10.0 \
+            grafana/alloy:v1.16.1 \
             run --server.http.listen-addr=127.0.0.1:12345 --disable-reporting /etc/alloy/config.alloy
           sleep 10
           docker logs alloy-test 2>&1 | tee /tmp/alloy.log
diff --git a/docker-compose.yml b/docker-compose.yml
index 1beaae1..25b4f55 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,7 +4,7 @@
 
 services:
   alloy:
-    image: grafana/alloy:v1.16.0
+    image: grafana/alloy:v1.16.1
     container_name: alloy
     restart: unless-stopped
     hostname: ${ALLOY_HOSTNAME:?required}
diff --git a/docs/upstream-sources-of-truth.md b/docs/upstream-sources-of-truth.md
index cb4d574..a6170f9 100644
--- a/docs/upstream-sources-of-truth.md
+++ b/docs/upstream-sources-of-truth.md
@@ -67,7 +67,7 @@ Both keep-lists in `docker-compose.yml` are copied verbatim from the **Metrics**
 
 Re-verification on 2026-04-26 also confirmed:
 
-- **Alloy image** bumped `v1.10.0` → `v1.16.0` (latest stable, released 2026-04-23).
+- **Alloy image** bumped `v1.10.0` → `v1.16.1` (latest stable; v1.16.0 released 2026-04-23, patched to v1.16.1 on 2026-05-05).
 - **`loki.source.journal` `path`** was previously pinned to `/var/log/journal`; upstream omits the field, letting Alloy default to **both** `/var/log/journal` (persistent) and `/run/log/journal` (volatile). Local now matches — `path` removed.
 
 The Grafana Cloud integration's full dashboard set (the 7 Linux-Node + 2 Docker dashboards) is not publicly hosted. Tier-4 verification (against the live stack via authenticated API) was **not** performed and is the only known gap.