diff --git a/docker/telemetry/docker-compose.yml b/docker/telemetry/docker-compose.yml
index cffe3d139a..78564d3de9 100644
--- a/docker/telemetry/docker-compose.yml
+++ b/docker/telemetry/docker-compose.yml
@@ -110,6 +110,10 @@ services:
       # the callback URL is how the renderer fetches the panel from grafana.
       - GF_RENDERING_SERVER_URL=http://renderer:8081/render
       - GF_RENDERING_CALLBACK_URL=http://grafana:3000/
+      # Grafana 13 turns the renderAuthJWT feature toggle on by default, which
+      # makes the renderer reject requests unless both sides share a token that
+      # is not the "-" default. Must match AUTH_TOKEN on the renderer service.
+      - GF_RENDERING_RENDERER_TOKEN=${GF_RENDERING_RENDERER_TOKEN:-xrpld-local-render}
     # SMTP for the critical-tier email receiver and the Slack webhook / email
     # address for the contact points all come from the env_file above, which
     # injects them straight into the container environment for Grafana to
@@ -133,7 +137,14 @@ services:
   # Grafana image renderer: a sidecar that renders panels/dashboards to PNG
   # for image export and alerting. Grafana calls it at http://renderer:8081.
   renderer:
-    image: grafana/grafana-image-renderer:latest
+    # Pinned like every other image in this stack so a stack that worked
+    # yesterday still works today. Upstream maintains only the newest release,
+    # which is expected to serve all supported Grafana versions.
+    image: grafana/grafana-image-renderer:v5.12.0
+    environment:
+      # Shared secret for the JWT-authenticated render requests Grafana 13
+      # sends. Must match GF_RENDERING_RENDERER_TOKEN on the grafana service.
+      - AUTH_TOKEN=${GF_RENDERING_RENDERER_TOKEN:-xrpld-local-render}
     ports:
       - "8081:8081" # Renderer HTTP endpoint (called by grafana)
     networks: