diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 7844c755..870f2a18 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -72,7 +72,7 @@ jobs:
           persist-credentials: false
 
       - name: Install just
-        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
+        uses: taiki-e/install-action@6cd13508893c0e7eab5f273c2575d3859bd7229a # v2.86.6
         with:
           tool: just
 
@@ -143,7 +143,7 @@ jobs:
           docker image tag "$IMAGE_NODE_URL" localhost/securedroporg-node
 
       - name: Install just
-        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
+        uses: taiki-e/install-action@6cd13508893c0e7eab5f273c2575d3859bd7229a # v2.86.6
         with:
           tool: just
 
diff --git a/.hadolint.yaml b/.hadolint.yaml
index 25dbf056..71e9b335 100644
--- a/.hadolint.yaml
+++ b/.hadolint.yaml
@@ -5,3 +5,7 @@ ignored:
   # builds silently whenever Debian trixie rotates a version, for no real
   # reproducibility gain.
   - DL3008
+  # We ensure that containers are run in prod with `runAsUser: 1000`,
+  # and also port dev UIDs into the container build, so we're sufficiently
+  # defensive about UIDs within the container.
+  - DL3066
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index dd745b4b..f95ff5eb 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/adamchainz/django-upgrade
-    rev: 1.31.1
+    rev: 1.32.0
     hooks:
       - id: django-upgrade
         args: [--target-version, '5.2']
@@ -25,7 +25,7 @@ repos:
       - id: check-yaml
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.3
+    rev: v0.16.4
     hooks:
       - id: ruff-check
         args: [--fix]
diff --git a/dev-requirements.txt b/dev-requirements.txt
index 93fbfa49..26ddccb7 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -474,9 +474,9 @@ django-webpack-loader==3.2.4 \
     --hash=sha256:0a253113ea6b150403cd2de802e732872c1d5e3185f0ad4a7fac673c00ae5af2 \
     --hash=sha256:a9d345746ae4d0700b9a86a7f0683ab8282c56a3a32736070f27ad658a9bfcb2
     # via -r requirements.txt
-djangorestframework==3.17.1 \
-    --hash=sha256:a6def5f447fe78ff853bff1d47a3c59bf38f5434b031780b351b0c73a62db1a5 \
-    --hash=sha256:c3c74dd3e83a5a3efc37b3c18d92bd6f86a6791c7b7d4dff62bb068500e76457
+djangorestframework==3.17.2 \
+    --hash=sha256:89ed713b6dc83e1539f214b7d10808ae19bb8511004beba886225da6d5c9dafa \
+    --hash=sha256:cb0546a7415d5b46c04e0f4fe0a54b2109f4fdd5e83ca773c8c6183a6493d042
     # via
     #   -r requirements.txt
     #   wagtail
diff --git a/docker-compose.yaml b/docker-compose.yaml
index b60981ff..bde45716 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -9,12 +9,12 @@ x-variables:
 
 services:
   postgresql:
-    image: docker.io/library/postgres:14
+    image: docker.io/library/postgres:17
     init: true
     ports:
       - '127.0.0.1:5432:5432'
     volumes:
-      - ./:/django:ro
+      - ./:/django:ro,z
     environment:
       POSTGRES_PASSWORD: *db-password
       POSTGRES_USER: *db-username
diff --git a/prod-docker-compose.yaml b/prod-docker-compose.yaml
index 07fdace9..a829d8a3 100644
--- a/prod-docker-compose.yaml
+++ b/prod-docker-compose.yaml
@@ -3,7 +3,7 @@ networks:
   app:
 services:
   postgresql:
-    image: docker.io/library/postgres:14
+    image: docker.io/library/postgres:17
     init: true
     ports:
       - '5432'
diff --git a/requirements.txt b/requirements.txt
index 4d1e0e96..e54521ab 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -337,9 +337,9 @@ django-webpack-loader==3.2.4 \
     --hash=sha256:0a253113ea6b150403cd2de802e732872c1d5e3185f0ad4a7fac673c00ae5af2 \
     --hash=sha256:a9d345746ae4d0700b9a86a7f0683ab8282c56a3a32736070f27ad658a9bfcb2
     # via -r requirements.in
-djangorestframework==3.17.1 \
-    --hash=sha256:a6def5f447fe78ff853bff1d47a3c59bf38f5434b031780b351b0c73a62db1a5 \
-    --hash=sha256:c3c74dd3e83a5a3efc37b3c18d92bd6f86a6791c7b7d4dff62bb068500e76457
+djangorestframework==3.17.2 \
+    --hash=sha256:89ed713b6dc83e1539f214b7d10808ae19bb8511004beba886225da6d5c9dafa \
+    --hash=sha256:cb0546a7415d5b46c04e0f4fe0a54b2109f4fdd5e83ca773c8c6183a6493d042
     # via
     #   -r requirements.in
     #   wagtail