diff --git a/install-graylog.sh b/install-graylog.sh
index a094d85..7c996f0 100644
--- a/install-graylog.sh
+++ b/install-graylog.sh
@@ -495,23 +495,36 @@ step_alerts() {
   fi
 
   log "Creating alert (event) definitions from $SCRIPT_DIR/alerts/*.json (idempotent)..."
+  # Same "compare content, PUT-update if changed" fix as step_pipeline_rules()/
+  # step_pipelines() - an alert's title never changes when its query/threshold
+  # does, so a plain title-exists check would silently skip the update
+  # forever. Confirmed live this session: alert7's query was fixed in git
+  # (vendor:accel-ppp -> vendor:accel-ppp AND event_type:*) but a re-run
+  # kept reporting "already exists" with the old, buggy query still live.
   local existing_defs
   existing_defs="$(gcurl GET /events/definitions)"
-  local f title id
+  local f title id body current_config desired_config
   for f in "$SCRIPT_DIR"/alerts/alert*.json; do
     [ -f "$f" ] || continue
     title="$(python3 -c "import json;print(json.load(open('$f'))['title'])")"
-    id="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(next((e['id'] for e in d['event_definitions'] if e['title']=='$title'),''))")"
-    if [ -n "$id" ]; then
-      skip "alert '$title' already exists ($id)"
-      continue
-    fi
-    local body
     body="$(sed \
       -e "s/__NETWORK_STREAM_ID__/$NETWORK_STREAM_ID/" \
       -e "s/__SERVERS_STREAM_ID__/$SERVERS_STREAM_ID/" \
       -e "s/__DISCORD_NOTIFICATION_ID__/$notif_id/" \
       "$f")"
+    id="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(next((e['id'] for e in d['event_definitions'] if e['title']=='$title'),''))")"
+    if [ -n "$id" ]; then
+      current_config="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(json.dumps(next(e['config'] for e in d['event_definitions'] if e['id']=='$id'),sort_keys=True))")"
+      desired_config="$(echo "$body" | python3 -c "import json,sys;print(json.dumps(json.load(sys.stdin)['config'],sort_keys=True))")"
+      if [ "$current_config" = "$desired_config" ]; then
+        skip "alert '$title' already up to date ($id)"
+        continue
+      fi
+      gcurl PUT "/events/definitions/$id" "$(echo "$body" | python3 -c "import json,sys;d=json.load(sys.stdin);d['id']='$id';print(json.dumps(d))")" >/dev/null
+      gcurl PUT "/events/definitions/$id/schedule" "" >/dev/null
+      ok "updated alert '$title' ($id) - config changed"
+      continue
+    fi
     id="$(gcurl POST /events/definitions "{\"entity\": ${body}, \"share_request\": {\"selected_grantee_capabilities\": {}}}" \
       | python3 -c "import json,sys;print(json.load(sys.stdin).get('id',''))")"
     [ -n "$id" ] || die "alert '$title' failed to create"