diff --git a/docs/changelog.d/+track-fly-versions.infra.md b/docs/changelog.d/+track-fly-versions.infra.md
new file mode 100644
index 0000000..2ec5b87
--- /dev/null
+++ b/docs/changelog.d/+track-fly-versions.infra.md
@@ -0,0 +1 @@
+Track Fly.io proxy component versions (Tailscale, nginx, Alloy) in service-versions.yaml with new `fly` service type.
diff --git a/service-versions.yaml b/service-versions.yaml
index af9f8ec..4f58a5b 100644
--- a/service-versions.yaml
+++ b/service-versions.yaml
@@ -5,7 +5,7 @@
 #
 # Fields:
 #   name            - kebab-case service identifier
-#   type            - argocd | ansible | nixos
+#   type            - argocd | ansible | nixos | fly
 #   last-reviewed   - date (YYYY-MM-DD) or null
 #   current-version - deployed version string or null
 #   upstream-source - URL to upstream releases/changelog
@@ -369,3 +369,27 @@ services:
     current-version: "1.11.0"
     upstream-source: https://www.pixeleyes.co.nz/automounter/
     notes: Mac App Store app, no Ansible role. Updates via App Store.
+
+  - name: flyio-tailscale
+    type: fly
+    last-reviewed: "2026-04-10"
+    current-version: "v1.94.1"
+    upstream-source: https://github.com/tailscale/tailscale/releases
+    notes: >-
+      Pinned after v1.96.5 broke MagicDNS in containers. Test DNS resolution
+      inside Fly container before upgrading. COPY --from in fly/Dockerfile.
+
+  - name: flyio-nginx
+    type: fly
+    last-reviewed: "2026-04-10"
+    current-version: "1.29.6-alpine"
+    upstream-source: https://hub.docker.com/_/nginx
+    notes: Base image for Fly proxy (fly/Dockerfile)
+
+  - name: flyio-alloy
+    type: fly
+    parent: flyio-nginx
+    last-reviewed: "2026-04-10"
+    current-version: "v1.14.1"
+    upstream-source: https://github.com/grafana/alloy/releases
+    notes: COPY --from in fly/Dockerfile for log shipping and metrics