diff --git a/idm/ldap-keycloak.yml b/idm/ldap-keycloak.yml
index 40b2110..678565d 100644
--- a/idm/ldap-keycloak.yml
+++ b/idm/ldap-keycloak.yml
@@ -64,7 +64,7 @@ services:
     restart: always
 
   postgres:
-    image: postgres:17-alpine
+    image: postgres:17.9-alpine
     networks:
       opencloud-net:
     volumes:
diff --git a/renovate.json b/renovate.json
index 1040162..385644d 100644
--- a/renovate.json
+++ b/renovate.json
@@ -17,6 +17,11 @@
       "matchBaseBranches": ["stable-4.0"],
       "matchUpdateTypes": ["major", "minor"],
       "enabled": false
+    },
+    {
+      "matchPackageNames": ["postgres"],
+      "matchManagers": ["docker-compose"],
+      "allowedVersions": "/^17\\.\\d+-alpine$/"
     }
   ],
   "docker-compose": {
diff --git a/testing/external-keycloak.yml b/testing/external-keycloak.yml
index 59c4d77..d8ecd27 100644
--- a/testing/external-keycloak.yml
+++ b/testing/external-keycloak.yml
@@ -1,7 +1,7 @@
 ---
 services:
   postgres:
-    image: postgres:17-alpine
+    image: postgres:17.9-alpine
     networks:
       opencloud-net:
     volumes: