diff --git a/.hadolint.yaml b/.hadolint.yaml
index 25dbf056..71e9b335 100644
--- a/.hadolint.yaml
+++ b/.hadolint.yaml
@@ -5,3 +5,7 @@ ignored:
   # builds silently whenever Debian trixie rotates a version, for no real
   # reproducibility gain.
   - DL3008
+  # We ensure that containers are run in prod with `runAsUser: 1000`,
+  # and also port dev UIDs into the container build, so we're sufficiently
+  # defensive about UIDs within the container.
+  - DL3066
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 7a261c6c..bde45716 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -9,7 +9,7 @@ x-variables:
 
 services:
   postgresql:
-    image: docker.io/library/postgres:14
+    image: docker.io/library/postgres:17
     init: true
     ports:
       - '127.0.0.1:5432:5432'
diff --git a/prod-docker-compose.yaml b/prod-docker-compose.yaml
index 07fdace9..a829d8a3 100644
--- a/prod-docker-compose.yaml
+++ b/prod-docker-compose.yaml
@@ -3,7 +3,7 @@ networks:
   app:
 services:
   postgresql:
-    image: docker.io/library/postgres:14
+    image: docker.io/library/postgres:17
     init: true
     ports:
       - '5432'