diff --git a/hosts/franz/arion/infrastructure/arion-compose.nix b/hosts/franz/arion/infrastructure/arion-compose.nix
index 44254a0..1a1208f 100644
--- a/hosts/franz/arion/infrastructure/arion-compose.nix
+++ b/hosts/franz/arion/infrastructure/arion-compose.nix
@@ -35,6 +35,11 @@
 
         "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme" = "https";
         "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto" = "https";
+
+        "diun.enable" = "true";
+        "diun.watch_repo" = "true";
+        "diun.sort_tags" = "semver";
+        "diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$$";
       };
       volumes = [
         "/home/ghoscht/.docker/infrastructure/traefik_config/traefik.yml:/traefik.yml:ro"
@@ -52,7 +57,7 @@
       ];
     };
     crowdsec.service = {
-      image = "crowdsecurity/crowdsec:v1.6.2";
+      image = "crowdsecurity/crowdsec:v1.6.3";
       container_name = "crowdsec";
       environment = {
         GID = "1000";
@@ -67,6 +72,12 @@
         "traefik-logs:/var/log/traefik/:ro"
         "/var/run/docker.sock:/var/run/docker.sock:ro"
       ];
+      labels = {
+        "diun.enable" = "true";
+        "diun.watch_repo" = "true";
+        "diun.sort_tags" = "semver";
+        "diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$$";
+      };
       depends_on = [
         "traefik"
       ];