diff --git a/roles/web-app-keycloak/meta/services.yml b/roles/web-app-keycloak/meta/services.yml
index 3575df6a97..e4ad93e494 100644
--- a/roles/web-app-keycloak/meta/services.yml
+++ b/roles/web-app-keycloak/meta/services.yml
@@ -101,11 +101,6 @@ sso_proxy:
   mem_reservation: "64m"
   mem_limit: "128m"
   pids_limit: 256
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "v7.15.5"
-        until: 2026-12-03
 # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
 postgres:
   bond: 1
diff --git a/roles/web-app-mattermost/meta/services.yml b/roles/web-app-mattermost/meta/services.yml
index ee6345d503..00d9e65f1f 100644
--- a/roles/web-app-mattermost/meta/services.yml
+++ b/roles/web-app-mattermost/meta/services.yml
@@ -65,11 +65,6 @@ mattermost:
     - web-app-stalwart
     - web-app-mailu
   lifecycle: beta
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "12.0.2"
-        until: 2026-12-03
 # nocheck: dynamic-flag
 # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests
 redis:
diff --git a/roles/web-app-nextcloud/meta/services.yml b/roles/web-app-nextcloud/meta/services.yml
index a152fbb3c8..301e25b982 100644
--- a/roles/web-app-nextcloud/meta/services.yml
+++ b/roles/web-app-nextcloud/meta/services.yml
@@ -169,11 +169,6 @@ context_agent:
     path: heartbeat
     # nocheck: healthcheck-timing-override  a sidecar of a stack whose main service alone takes minutes; the value predates this default and has not been measured against it
     start_period: 20m
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "2.10.0"
-        until: 2026-12-03
 # nocheck: playwright-service-flag  MCP sidecar, no browser surface
 # nocheck: dynamic-flag  the sidecar fronts this role's MCP surface, so it tracks the role's own mcp flag rather than one client's presence
 contextagentmcp:
diff --git a/roles/web-app-wazuh/meta/services.yml b/roles/web-app-wazuh/meta/services.yml
index 68fdddbcb1..a3ed60f9e1 100644
--- a/roles/web-app-wazuh/meta/services.yml
+++ b/roles/web-app-wazuh/meta/services.yml
@@ -84,11 +84,6 @@ manager:
       agent_events: 1514
       agent_registration: 1515
       api: 55000
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "4.14.9"
-        until: 2026-12-03
 indexer:
   healthcheck:
     test:
@@ -119,11 +114,6 @@ indexer:
       http: 9200
     local:
       http: 8097
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "4.14.9"
-        until: 2026-12-03
 console:
   image: wazuh/wazuh-dashboard
   version: "4.14.10"
@@ -139,11 +129,6 @@ console:
       http: 5601
     local:
       http: 8096
-  security:
-    suppressions:
-      # nocheck: cve upstream tag ships fixable CRITICAL CVEs; lift it once a rebuilt tag lands
-      - image_tag: "4.14.9"
-        until: 2026-12-03
 
 # nocheck: playwright-service-flag
 # nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in