The image is pinned to the reviewed amd64 digest.
Logs use the loki AIStor bucket through loki-object-storage; no root credential is referenced.
Retention is 30 days. The WAL and working data use the dedicated 5Gi Retain Local PV.
Gateway, canary, caches, embedded MinIO, tests, and rule sidecars are disabled.
The only client-facing service is ClusterIP port 3100.

Do not delete the PVC or bucket during rollback. Scale the StatefulSet down, preserve its Retain volume, and investigate S3/WAL state before reapplying.