diff --git a/argocd/manifests/grafana/kustomization.yaml b/argocd/manifests/grafana/kustomization.yaml
index 3aeaa26..4fe53a9 100644
--- a/argocd/manifests/grafana/kustomization.yaml
+++ b/argocd/manifests/grafana/kustomization.yaml
@@ -18,7 +18,7 @@ images:
   - name: registry.ops.eblu.me/blumeops/grafana-sidecar
     newTag: v1.28.0-613f05d
   - name: registry.ops.eblu.me/blumeops/grafana
-    newTag: v12.3.3-613f05d
+    newTag: v12.4.2-4c54774
 
 configMapGenerator:
   - name: grafana
diff --git a/containers/grafana/Dockerfile b/containers/grafana/Dockerfile
index 3d5b12b..3b33dd9 100644
--- a/containers/grafana/Dockerfile
+++ b/containers/grafana/Dockerfile
@@ -1,4 +1,4 @@
-ARG CONTAINER_APP_VERSION=12.3.3
+ARG CONTAINER_APP_VERSION=12.4.2
 
 FROM alpine:3.22
 
diff --git a/docs/changelog.d/upgrade-grafana-12.4.2.infra.md b/docs/changelog.d/upgrade-grafana-12.4.2.infra.md
new file mode 100644
index 0000000..11bba26
--- /dev/null
+++ b/docs/changelog.d/upgrade-grafana-12.4.2.infra.md
@@ -0,0 +1 @@
+Upgrade Grafana from 12.3.3 to 12.4.2 — patches 7 CVEs including an unauthenticated DoS (CVE-2026-27880).
diff --git a/service-versions.yaml b/service-versions.yaml
index b8441c0..2a568b4 100644
--- a/service-versions.yaml
+++ b/service-versions.yaml
@@ -97,8 +97,8 @@ services:
 
   - name: grafana
     type: argocd
-    last-reviewed: 2026-02-23
-    current-version: "12.3.3"
+    last-reviewed: 2026-04-02
+    current-version: "12.4.2"
     upstream-source: https://github.com/grafana/grafana/releases
     notes: Home-built container from Alpine; upgraded from Helm to Kustomize