diff --git a/argocd/manifests/alloy-k8s/config.alloy b/argocd/manifests/alloy-k8s/config.alloy
index 86c0747..c169c93 100644
--- a/argocd/manifests/alloy-k8s/config.alloy
+++ b/argocd/manifests/alloy-k8s/config.alloy
@@ -100,6 +100,18 @@ loki.process "pods" {
     values = ["__error__", "__error_details__"]
   }
 
+  // Normalize 1password-connect numeric log levels to strings (1=error..5=trace)
+  // Scoped to the 1password namespace so other services are unaffected.
+  // See: https://github.com/1Password/connect/issues/44
+  stage.match {
+    selector = "{namespace=\"1password\"}"
+
+    stage.template {
+      source   = "level"
+      template = "{{ if eq .Value \"1\" }}error{{ else if eq .Value \"2\" }}warn{{ else if eq .Value \"3\" }}info{{ else if eq .Value \"4\" }}debug{{ else if eq .Value \"5\" }}trace{{ else }}{{ .Value }}{{ end }}"
+    }
+  }
+
   // Extract labels from parsed JSON data
   stage.labels {
     values = {
diff --git a/docs/changelog.d/fix-onepassword-numeric-log-levels.bugfix.md b/docs/changelog.d/fix-onepassword-numeric-log-levels.bugfix.md
new file mode 100644
index 0000000..74f2a99
--- /dev/null
+++ b/docs/changelog.d/fix-onepassword-numeric-log-levels.bugfix.md
@@ -0,0 +1 @@
+Fix 1Password Connect logs showing as errors in Grafana by normalizing numeric log levels (1-5) to standard strings (error/warn/info/debug/trace) in the Alloy log processing pipeline.