diff --git a/admin-system/renovate.yaml b/admin-system/renovate.yaml
index 9ab2014..178422d 100644
--- a/admin-system/renovate.yaml
+++ b/admin-system/renovate.yaml
@@ -114,6 +114,15 @@ data:
           "matchPackageNames": ["getmeili/meilisearch"],
           "dependencyDashboardApproval": true
         },
+        {
+          "description": "Postgres-family images: a major bump (e.g. 16 -> 17) requires pg_upgrade or dump/restore — the new server binary refuses to open the old data directory (`database files are incompatible with server`). PR #76 (immich-app/postgres 16 -> 17) on 2026-06-06 crashlooped immich-postgres and immich-server. Renovate's docker versioning treats these custom tag formats inconsistently, so don't trust the major/minor classification: hold ALL updates for these images behind explicit dashboard approval. Includes vanilla postgres, postgis/postgis (where the tag prefix IS the pg major), and ghcr.io/immich-app/postgres (custom `N-vectorchordX.Y.Z` form).",
+          "matchPackageNames": [
+            "postgres",
+            "postgis/postgis",
+            "ghcr.io/immich-app/postgres"
+          ],
+          "dependencyDashboardApproval": true
+        },
         {
           "description": "termix: kubernetes manager would extract the image with versioning=docker and silently skip it (release-1.11.0 fails the docker pre-check). Disable that extraction; customManagers above does the real work via github-releases.",
           "matchManagers": ["kubernetes"],
diff --git a/immich-system/immich.yaml b/immich-system/immich.yaml
index 2116b84..fdc7912 100644
--- a/immich-system/immich.yaml
+++ b/immich-system/immich.yaml
@@ -45,7 +45,7 @@ spec:
         fsGroup: 999
       containers:
         - name: postgres
-          image: ghcr.io/immich-app/postgres:17-vectorchord0.3.0
+          image: ghcr.io/immich-app/postgres:16-vectorchord0.3.0
           env:
             - name: POSTGRES_USER
               valueFrom: