diff --git a/docs/concepts/qa-e2e-automation.md b/docs/concepts/qa-e2e-automation.md
index 413d5dc02ac6..8a4a0f34b536 100644
--- a/docs/concepts/qa-e2e-automation.md
+++ b/docs/concepts/qa-e2e-automation.md
@@ -214,7 +214,7 @@ Matrix live implementations live under
 `extensions/qa-lab/src/live-transports/matrix/scenarios/`.
 
 The adapter provisions a disposable Tuwunel homeserver in Docker (default image
-`ghcr.io/matrix-construct/tuwunel:v1.6.2`, pinned to its multi-architecture OCI
+`ghcr.io/matrix-construct/tuwunel:v1.8.2`, pinned to its multi-architecture OCI
 index digest; server name `matrix-qa.test`, port `28008`), registers temporary
 driver, SUT, and observer users, seeds the required rooms, and records the
 redacted request/response boundary. It then runs the real Matrix plugin inside
diff --git a/extensions/qa-lab/src/live-transports/matrix/substrate/harness.runtime-internals.ts b/extensions/qa-lab/src/live-transports/matrix/substrate/harness.runtime-internals.ts
index 47c44409b851..6274d399e824 100644
--- a/extensions/qa-lab/src/live-transports/matrix/substrate/harness.runtime-internals.ts
+++ b/extensions/qa-lab/src/live-transports/matrix/substrate/harness.runtime-internals.ts
@@ -4,7 +4,7 @@ import path from "node:path";
 import type { FetchLike } from "../../../docker-runtime.js";
 
 const MATRIX_QA_DEFAULT_IMAGE =
-  "ghcr.io/matrix-construct/tuwunel:v1.6.2@sha256:43ca6a5c13841b4e40c99370ab1518b5692953ee3b661f91ee10d002249af375";
+  "ghcr.io/matrix-construct/tuwunel:v1.8.2@sha256:6f950bb139411a7964781e986321e395e045e4a6a52240a4dda9d23d04075f78";
 const MATRIX_QA_DEFAULT_SERVER_NAME = "matrix-qa.test";
 export const MATRIX_QA_INTERNAL_PORT = 8008;
 export const MATRIX_QA_SERVICE = "matrix-qa-homeserver";
diff --git a/extensions/qa-lab/src/live-transports/matrix/substrate/harness.runtime.test.ts b/extensions/qa-lab/src/live-transports/matrix/substrate/harness.runtime.test.ts
index 4c7cefab61c3..b639c78a3ff8 100644
--- a/extensions/qa-lab/src/live-transports/matrix/substrate/harness.runtime.test.ts
+++ b/extensions/qa-lab/src/live-transports/matrix/substrate/harness.runtime.test.ts
@@ -101,7 +101,7 @@ describe("matrix harness runtime", () => {
 
       const compose = await readFile(result.composeFile, "utf8");
       expect(compose).toContain(
-        "image: ghcr.io/matrix-construct/tuwunel:v1.6.2@sha256:43ca6a5c13841b4e40c99370ab1518b5692953ee3b661f91ee10d002249af375",
+        "image: ghcr.io/matrix-construct/tuwunel:v1.8.2@sha256:6f950bb139411a7964781e986321e395e045e4a6a52240a4dda9d23d04075f78",
       );
       expect(compose).toContain('      - "127.0.0.1:28008:8008"');
       expect(compose).toContain('TUWUNEL_ALLOW_ENCRYPTION: "true"');