diff --git a/.github/renovate.json b/.github/renovate.json
index 9e0e531f7..761bff78a 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -83,6 +83,7 @@
     {
       "matchPackageNames": [
         "!/^github\\.com\\/sapcc\\/.*/",
+        "!postgres",
         "/.*/"
       ],
       "matchUpdateTypes": [
diff --git a/cmd/manager/main.go b/cmd/manager/main.go
index 1e7a518a1..6ca021167 100644
--- a/cmd/manager/main.go
+++ b/cmd/manager/main.go
@@ -7,11 +7,13 @@ import (
 	"context"
 	"crypto/tls"
 	"flag"
+	"fmt"
 	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
 	"slices"
+	"strings"
 	"time"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
@@ -151,10 +153,31 @@ func main() {
 
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 
-	// Configure slog (used across internal packages) with structured JSON output.
+	// Configure slog (used across internal packages) with JSON output and
+	// level control via the LOG_LEVEL environment variable.
+	// Supported values: debug, info (default), warn, error.
+	slogLevel := new(slog.LevelVar)
+	slogLevel.Set(slog.LevelInfo)
+	if lvl := os.Getenv("LOG_LEVEL"); lvl != "" {
+		switch strings.ToLower(lvl) {
+		case "debug":
+			slogLevel.Set(slog.LevelDebug)
+		case "info":
+			slogLevel.Set(slog.LevelInfo)
+		case "warn", "warning":
+			slogLevel.Set(slog.LevelWarn)
+		case "error":
+			slogLevel.Set(slog.LevelError)
+		default:
+			slogLevel.Set(slog.LevelInfo)
+			setupLog.Error(fmt.Errorf("unknown LOG_LEVEL %q, defaulting to info", lvl), "invalid log level",
+				"supported", []string{"debug", "info", "warn", "warning", "error"})
+		}
+	}
 	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
-		Level: slog.LevelInfo,
+		Level: slogLevel,
 	})))
+	slog.Info("slog configured", "level", slogLevel.Level().String())
 
 	// Log the main configuration
 	setupLog.Info("loaded main configuration",
diff --git a/cortex.secrets.example.yaml b/cortex.secrets.example.yaml
index daab61cc9..76d7f2d55 100644
--- a/cortex.secrets.example.yaml
+++ b/cortex.secrets.example.yaml
@@ -1,8 +1,9 @@
 # Copyright SAP SE
 # SPDX-License-Identifier: Apache-2.0
 
-# Override config values that contain sensitive information or
-# are specific to your environment. These values can be used in the Tiltfile.
+# Override config values for local development. This includes secrets,
+# environment-specific settings, and logging configuration.
+# These values can be used in the Tiltfile.
 
 # SSO certificate to use.
 sharedSSOCert: &sharedSSOCert
@@ -20,6 +21,23 @@ sharedSSOCert: &sharedSSOCert
   # If true, the certificate is not verified.
   selfSigned: "false"
 
+# Logging configuration for local development.
+# Set logLevel to "debug" for verbose output from both zap and slog loggers.
+# Set zapDevel to true for human-readable console logs instead of JSON.
+# These apply per sub-chart, for example:
+#
+# cortex-scheduling-controllers:
+#   controllerManager:
+#     container:
+#       logLevel: "debug"
+#       zapDevel: true
+#
+# cortex-knowledge-controllers:
+#   controllerManager:
+#     container:
+#       logLevel: "debug"
+#       zapDevel: true
+
 # Enable kvm pipelines and scheduling support.
 kvm:
   enabled: true
diff --git a/helm/library/cortex/templates/_helpers.tpl b/helm/library/cortex/templates/_helpers.tpl
index 782e14eef..3afa8c2f7 100644
--- a/helm/library/cortex/templates/_helpers.tpl
+++ b/helm/library/cortex/templates/_helpers.tpl
@@ -41,6 +41,22 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{ $hasMutating }}}}{{- end }}
 
 
+{{/*
+chart.argsContainPrefix checks if any string in args starts with prefix.
+Usage: include "chart.argsContainPrefix" (dict "prefix" "--zap-log-level" "args" .Values.controllerManager.container.args)
+Returns "true" or "false".
+*/}}
+{{- define "chart.argsContainPrefix" -}}
+{{- $prefix := .prefix -}}
+{{- $result := dict "found" "false" -}}
+{{- range .args -}}
+  {{- if hasPrefix $prefix . -}}
+    {{- $_ := set $result "found" "true" -}}
+  {{- end -}}
+{{- end -}}
+{{- get $result "found" -}}
+{{- end -}}
+
 {{- define "chart.hasValidatingWebhooks" -}}
 {{- $hasValidating := false }}
 {{- range . }}
diff --git a/helm/library/cortex/templates/manager/manager.yaml b/helm/library/cortex/templates/manager/manager.yaml
index 0c9f362aa..052b99170 100644
--- a/helm/library/cortex/templates/manager/manager.yaml
+++ b/helm/library/cortex/templates/manager/manager.yaml
@@ -35,6 +35,12 @@ spec:
             {{- range .Values.controllerManager.container.args }}
             - {{ . }}
             {{- end }}
+            {{- if and .Values.controllerManager.container.logLevel (ne (include "chart.argsContainPrefix" (dict "prefix" "--zap-log-level" "args" .Values.controllerManager.container.args)) "true") }}
+            - "--zap-log-level={{ .Values.controllerManager.container.logLevel }}"
+            {{- end }}
+            {{- if and .Values.controllerManager.container.zapDevel (ne (include "chart.argsContainPrefix" (dict "prefix" "--zap-devel" "args" .Values.controllerManager.container.args)) "true") }}
+            - "--zap-devel"
+            {{- end }}
             {{- if and .Values.webhook.enable .Values.certmanager.enable }}
             - "--webhook-cert-path=/tmp/k8s-webhook-server/serving-certs"
             {{- end }}
@@ -56,13 +62,17 @@ spec:
           {{- if .Values.controllerManager.container.image.pullPolicy }}
           imagePullPolicy: {{ .Values.controllerManager.container.image.pullPolicy }}
           {{- end }}
-          {{- if .Values.controllerManager.container.env }}
           env:
+            {{- if and .Values.controllerManager.container.logLevel (not (and .Values.controllerManager.container.env (hasKey .Values.controllerManager.container.env "LOG_LEVEL"))) }}
+            - name: LOG_LEVEL
+              value: {{ .Values.controllerManager.container.logLevel | quote }}
+            {{- end }}
+            {{- if .Values.controllerManager.container.env }}
             {{- range $key, $value := .Values.controllerManager.container.env }}
             - name: {{ $key }}
               value: {{ $value }}
             {{- end }}
-          {{- end }}
+            {{- end }}
           livenessProbe:
             {{- toYaml .Values.controllerManager.container.livenessProbe | nindent 12 }}
           readinessProbe:
@@ -140,4 +150,4 @@ data:
     {{- $mergedSecrets = mergeOverwrite .Values.secrets $mergedSecrets }}
     {{- end }}
     {{ toJson $mergedSecrets | b64enc }}
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/helm/library/cortex/values.yaml b/helm/library/cortex/values.yaml
index ad3c7ba8b..f6b94c9ef 100644
--- a/helm/library/cortex/values.yaml
+++ b/helm/library/cortex/values.yaml
@@ -13,6 +13,14 @@ controllerManager:
       - "--metrics-bind-address=:2112"
       - "--health-probe-bind-address=:8081"
       - "--metrics-secure=false"
+    # Log level for both zap (controller-runtime) and slog (internal packages).
+    # Supported: debug, info (default), warn, error.
+    logLevel: "info"
+    # Enable zap development mode (human-readable console logs, development stack traces).
+    # This only changes output format and stack trace behavior, not the log level.
+    # The effective log level is controlled by logLevel above (default: "info").
+    # Set to true for local development (e.g. Tilt), keep false for production.
+    zapDevel: false
     resources:
       limits:
         cpu: 500m
diff --git a/internal/scheduling/nova/plugins/filters/filter_capabilities.go b/internal/scheduling/nova/plugins/filters/filter_capabilities.go
index 0aec4b22d..cda9a9a20 100644
--- a/internal/scheduling/nova/plugins/filters/filter_capabilities.go
+++ b/internal/scheduling/nova/plugins/filters/filter_capabilities.go
@@ -95,8 +95,8 @@ func (s *FilterCapabilitiesStep) Run(traceLog *slog.Logger, request api.External
 	for _, hv := range hvs.Items {
 		caps, err := hvToNovaCapabilities(hv)
 		if err != nil {
-			traceLog.Warn("skipping hypervisor with unknown capabilities", "host", hv.Name, "error", err)
-			continue
+			traceLog.Warn("hypervisor has unknown capabilities, using empty defaults", "host", hv.Name, "error", err)
+			caps = make(map[string]string)
 		}
 		hvCaps[hv.Name] = caps
 	}
diff --git a/postgres/README.md b/postgres/README.md
index e6fc17a78..e6693cf7a 100644
--- a/postgres/README.md
+++ b/postgres/README.md
@@ -4,4 +4,4 @@ https://github.com/docker-library/postgres with the most recent stable version o
 
 Also contains some minor changes, such as that `gosu` is directly installed over apt.
 
-Current postgres version: `v17.6`
+Current postgres version: `v17.9`