diff --git a/.gitea/workflows/production.yaml b/.gitea/workflows/production.yaml
index d708e1c..634506f 100644
--- a/.gitea/workflows/production.yaml
+++ b/.gitea/workflows/production.yaml
@@ -171,7 +171,7 @@ jobs:
           # Start shared infrastructure services (database, cache, logging)
           # These persist across blue-green deployments
           docker compose -f $COMPOSE_FILE -f $COMPOSE_BLUE_GREEN -f $COMPOSE_PROD up -d \
-            mvp-postgres mvp-redis mvp-loki mvp-promtail mvp-grafana
+            mvp-postgres mvp-redis mvp-loki mvp-alloy mvp-grafana
 
       - name: Start target stack
         run: |
diff --git a/CLAUDE.md b/CLAUDE.md
index 592ada1..b177d0c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,6 +1,6 @@
 # MotoVaultPro
 
-Single-tenant vehicle management application with 9-container architecture (6 application: Traefik, Frontend, Backend, OCR, PostgreSQL, Redis + 3 logging: Loki, Promtail, Grafana).
+Single-tenant vehicle management application with 9-container architecture (6 application: Traefik, Frontend, Backend, OCR, PostgreSQL, Redis + 3 logging: Loki, Alloy, Grafana).
 
 ## Files
 
@@ -173,7 +173,7 @@ Issues are the source of truth. See `.ai/workflow-contract.json` for complete wo
 ## Architecture Context for AI
 
 ### 9-Container Architecture
-**MotoVaultPro uses a unified architecture:** A single-tenant application with 9 containers - 6 application (Traefik, Frontend, Backend, OCR, PostgreSQL, Redis) + 3 logging (Loki, Promtail, Grafana). Application features in `backend/src/features/[name]/` are self-contained modules within the backend service, including the platform feature for vehicle data and VIN decoding. See `docs/LOGGING.md` for unified logging system documentation.
+**MotoVaultPro uses a unified architecture:** A single-tenant application with 9 containers - 6 application (Traefik, Frontend, Backend, OCR, PostgreSQL, Redis) + 3 logging (Loki, Alloy, Grafana). Application features in `backend/src/features/[name]/` are self-contained modules within the backend service, including the platform feature for vehicle data and VIN decoding. See `docs/LOGGING.md` for unified logging system documentation.
 
 ### Key Principles for AI Understanding
 - **Feature Capsule Organization**: Application features are self-contained modules within the backend
diff --git a/config/alloy/config.alloy b/config/alloy/config.alloy
new file mode 100644
index 0000000..91e5ae6
--- /dev/null
+++ b/config/alloy/config.alloy
@@ -0,0 +1,29 @@
+discovery.docker "containers" {
+  host             = "unix:///var/run/docker.sock"
+  refresh_interval = "5s"
+}
+
+discovery.relabel "containers" {
+  targets = discovery.docker.containers.targets
+  rule {
+    source_labels = ["__meta_docker_container_name"]
+    regex         = "/(.*)"
+    target_label  = "container"
+  }
+  rule {
+    source_labels = ["__meta_docker_container_label_com_docker_compose_service"]
+    target_label  = "service"
+  }
+}
+
+loki.source.docker "containers" {
+  host       = "unix:///var/run/docker.sock"
+  targets    = discovery.relabel.containers.output
+  forward_to = [loki.write.default.receiver]
+}
+
+loki.write "default" {
+  endpoint {
+    url = "http://mvp-loki:3100/loki/api/v1/push"
+  }
+}
diff --git a/config/promtail/config.yml b/config/promtail/config.yml
deleted file mode 100644
index 48bf9ab..0000000
--- a/config/promtail/config.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-server:
-  http_listen_port: 9080
-  grpc_listen_port: 0
-
-positions:
-  filename: /tmp/positions.yaml
-
-clients:
-  - url: http://mvp-loki:3100/loki/api/v1/push
-
-scrape_configs:
-  - job_name: containers
-    docker_sd_configs:
-      - host: unix:///var/run/docker.sock
-        refresh_interval: 5s
-    relabel_configs:
-      - source_labels: ['__meta_docker_container_name']
-        regex: '/(.*)'
-        target_label: 'container'
-      - source_labels: ['__meta_docker_container_label_com_docker_compose_service']
-        target_label: 'service'
diff --git a/docker-compose.yml b/docker-compose.yml
index 814a76f..de4259c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -286,16 +286,20 @@ services:
         max-size: "10m"
         max-file: "3"
 
-  # Log Aggregation - Promtail
-  mvp-promtail:
-    image: ${REGISTRY_MIRRORS:-git.motovaultpro.com/egullickson/mirrors}/grafana/promtail:2.9.0
-    container_name: mvp-promtail
+  # Log Aggregation - Alloy (replaces Promtail)
+  mvp-alloy:
+    image: ${REGISTRY_MIRRORS:-git.motovaultpro.com/egullickson/mirrors}/grafana/alloy:v1.12.2
+    container_name: mvp-alloy
     restart: unless-stopped
     volumes:
-      - ./config/promtail/config.yml:/etc/promtail/config.yml:ro
+      - ./config/alloy/config.alloy:/etc/alloy/config.alloy
       - /var/lib/docker/containers:/var/lib/docker/containers:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
-    command: -config.file=/etc/promtail/config.yml
+    command:
+      - run
+      - --server.http.listen-addr=0.0.0.0:12345
+      - --storage.path=/var/lib/alloy/data
+      - /etc/alloy/config.alloy
     networks:
       - backend
     depends_on:
diff --git a/docs/LOGGING.md b/docs/LOGGING.md
index 0cfffff..19d818d 100644
--- a/docs/LOGGING.md
+++ b/docs/LOGGING.md
@@ -102,14 +102,14 @@ This creates `.env.logging` which is sourced by docker-compose.
 +-----------------------------------------------------------------------+
                            |
                            v
-              Promtail --> Loki (30-day retention) --> Grafana
+              Alloy --> Loki (30-day retention) --> Grafana
 ```
 
 ## Troubleshooting
 
 ### Logs not appearing in Grafana
 
-1. Check Promtail is running: `docker logs mvp-promtail`
+1. Check Alloy is running: `docker logs mvp-alloy`
 2. Check Loki is healthy: `curl http://localhost:3100/ready`
 3. Verify log rotation is not too aggressive