diff --git a/templates/paperless-ngx/.felhom.yml b/templates/paperless-ngx/.felhom.yml
index a8e13d5..d66a2c8 100644
--- a/templates/paperless-ngx/.felhom.yml
+++ b/templates/paperless-ngx/.felhom.yml
@@ -26,7 +26,7 @@ subdomain: "paperless"                # -> paperless.<domain>
 slug: "paperless-ngx"
 # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
 # changes an image: line must set this to the same day (see CLAUDE.md).
-catalog_since: "2026-07-18"
+catalog_since: "2026-09-27"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
@@ -241,3 +241,9 @@ i18n:
       prerequisites:
         - 'An external hard drive is recommended to keep the documents on'
         - 'At least 1 GB of free RAM (for the OCR work)'
+
+# update_ladder — the test record: one tested step per line, oldest first (JSON flow mappings,
+# `09-update-architecture.md` §6.4 part 4). WRITTEN BY scripts/upgrade-test.py, never by hand;
+# gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
+update_ladder:
+  - {"from": {"paperless-webserver": "ghcr.io/paperless-ngx/paperless-ngx:2.20.15", "paperless-postgres": "postgres:16-alpine", "paperless-redis": "redis:7-alpine"}, "to": {"paperless-webserver": "ghcr.io/paperless-ngx/paperless-ngx:2.20.15", "paperless-postgres": "postgres:18-alpine", "paperless-redis": "redis:7-alpine"}, "digest": {"paperless-postgres": "sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873", "paperless-redis": "sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499", "paperless-webserver": "sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f"}, "verdict": "proven", "tested_at": "2026-09-27T09:50:50Z", "harness_version": 4, "evidence": "felhom.eu/documentation/audits/version-travel-2026-09-26/B/apps/paperless-ngx/bench/evidence/MV-paperless-ngx/verdict.json", "box_evidence": "felhom.eu/documentation/audits/version-travel-2026-09-26/B/apps/paperless-ngx/box/box-verdict-paperless-ngx.json", "memory_peak_pct": 40.0, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 72.0, "engine_conversion": {"service": "paperless-postgres", "engine": "postgres", "from": 16, "to": 18}}
diff --git a/templates/paperless-ngx/docker-compose.yml b/templates/paperless-ngx/docker-compose.yml
index 546eec4..9f3dd3a 100644
--- a/templates/paperless-ngx/docker-compose.yml
+++ b/templates/paperless-ngx/docker-compose.yml
@@ -94,7 +94,7 @@ services:
       - "traefik.http.services.paperless.loadbalancer.server.port=8000"
 
   paperless-postgres:
-    image: postgres:16-alpine
+    image: postgres:18-alpine
     container_name: paperless-postgres
     restart: unless-stopped
     environment:
@@ -103,7 +103,7 @@ services:
       - POSTGRES_DB=paperless
       - TZ=Europe/Budapest
     volumes:
-      - paperless_postgres_data:/var/lib/postgresql/data
+      - paperless_postgres_data:/var/lib/postgresql
     networks:
       - paperless-internal
     deploy: