diff --git a/argocd/manifests/alloy-k8s/config.alloy b/argocd/manifests/alloy-k8s/config.alloy
index 86c0747..5aec0c5 100644
--- a/argocd/manifests/alloy-k8s/config.alloy
+++ b/argocd/manifests/alloy-k8s/config.alloy
@@ -109,6 +109,29 @@ loki.process "pods" {
     }
   }
 
+  // Map numeric log levels (e.g. 1Password Connect: 1=error,2=warn,3=info,4=debug)
+  // to standard strings so Grafana logs panel colors them correctly
+  stage.replace {
+    source     = "level"
+    expression = "^1$"
+    replace    = "error"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^2$"
+    replace    = "warn"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^3$"
+    replace    = "info"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^4$"
+    replace    = "debug"
+  }
+
   // Add cluster label for multi-cluster identification
   stage.static_labels {
     values = { cluster = "indri" }
diff --git a/argocd/manifests/alloy-ringtail/config.alloy b/argocd/manifests/alloy-ringtail/config.alloy
index 9ae8981..61eb75e 100644
--- a/argocd/manifests/alloy-ringtail/config.alloy
+++ b/argocd/manifests/alloy-ringtail/config.alloy
@@ -147,6 +147,29 @@ loki.process "pods" {
     }
   }
 
+  // Map numeric log levels (1Password Connect uses 1=error,2=warn,3=info,4=debug)
+  // to standard strings so Grafana logs panel colors them correctly
+  stage.replace {
+    source     = "level"
+    expression = "^1$"
+    replace    = "error"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^2$"
+    replace    = "warn"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^3$"
+    replace    = "info"
+  }
+  stage.replace {
+    source     = "level"
+    expression = "^4$"
+    replace    = "debug"
+  }
+
   // Add cluster label for multi-cluster identification
   stage.static_labels {
     values = { cluster = "ringtail" }