diff --git a/flake.lock b/flake.lock
index e27e4ee..d3d2dd3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -446,16 +446,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1790189499,
-        "narHash": "sha256-iBulH/GVjue0QkaTQIfg0b90vlTirlUrS1yL8D8Czts=",
+        "lastModified": 1790191351,
+        "narHash": "sha256-XJhq+BEccNUP8FLnpkuZhrxDqhW+Yq9uXmN9Pf0MESQ=",
         "ref": "refs/heads/master",
-        "rev": "3687636ed714cc559ed5f5b87025219222bf3aa2",
-        "revCount": 31,
+        "rev": "429f6b207eab4bb480f21ca5dd9caafb6b55e9d5",
+        "revCount": 34,
         "type": "git",
         "url": "ssh://git@git.wntrmute.dev/kyle/sift"
       },
       "original": {
-        "rev": "3687636ed714cc559ed5f5b87025219222bf3aa2",
+        "rev": "429f6b207eab4bb480f21ca5dd9caafb6b55e9d5",
         "type": "git",
         "url": "ssh://git@git.wntrmute.dev/kyle/sift"
       }
diff --git a/flake.nix b/flake.nix
index 89805d6..48987a5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,7 +23,7 @@
     tracker.url = "git+https://git.wntrmute.dev/kyle/tracker";
     tracker.inputs.nixpkgs.follows = "nixpkgs";
 
-    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=3687636ed714cc559ed5f5b87025219222bf3aa2";
+    sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=429f6b207eab4bb480f21ca5dd9caafb6b55e9d5";
     sift.inputs.nixpkgs.follows = "nixpkgs";
 
     tether.url = "git+ssh://git@git.wntrmute.dev/kyle/tether?rev=c89894b8dcac89aaea9ad72529524c1204884bc0";
diff --git a/hw/orion/default.nix b/hw/orion/default.nix
index ec85806..6b6ec79 100644
--- a/hw/orion/default.nix
+++ b/hw/orion/default.nix
@@ -31,6 +31,7 @@
         engines = [
           { name = "bing"; disabled = false; }
           { name = "braveapi"; api_key = "$BRAVE_API_KEY"; disabled = false; inactive = false; }
+          # Scraper logs full q= into the journal on HTTP failures; braveapi covers it.
           { name = "brave"; disabled = true; }
           { name = "duckduckgo"; disabled = true; }
           { name = "startpage"; disabled = true; }
@@ -45,6 +46,10 @@
       };
     };
 
+    # Python WARNING logs from engines include the query string. Restricted
+    # callers must not land q= in a journal fleet logins can read.
+    systemd.services.searx.serviceConfig.LogLevelMax = "err";
+
     # searx-init loads EnvironmentFile at spawn. The file must exist before
     # systemd starts that unit. activationScripts run after users/groups and
     # before units, so the first boot/switch cannot race.