diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 7c06cd1..1115759 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -70,7 +70,7 @@ services:
     expose:
     - '8080'
   envoy:
-    image: envoyproxy/envoy:v1.38-latest
+    image: envoyproxy/envoy:v1.39-latest
     # Run Envoy as a non-root user matching host UID/GID so a host-mounted
     # tls.key with mode 600 remains readable without elevating container privileges.
     user: "${LOCAL_UID:-1000}:${LOCAL_GID:-1000}"