diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 46efc732f..7d8e7f98f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -38,3 +38,12 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 3
+    ignore:
+      # A PostgreSQL major is a migration, not an update: the on-disk format
+      # changes, so the operator has to run pg_upgrade or dump and restore.
+      # The first run of this ecosystem proposed 16.15 -> 18.6, which would
+      # have handed self-hosters a database their data directory cannot be
+      # read by. Minor releases still arrive as PRs; a major is a deliberate
+      # project decision with a migration guide behind it.
+      - dependency-name: "postgres"
+        update-types: ["version-update:semver-major"]
diff --git a/src/__tests__/database-pin-is-watched.test.ts b/src/__tests__/database-pin-is-watched.test.ts
index 2ab74ceff..09c740e0b 100644
--- a/src/__tests__/database-pin-is-watched.test.ts
+++ b/src/__tests__/database-pin-is-watched.test.ts
@@ -36,6 +36,16 @@ describe("the bundled database pin", () => {
     expect(images[0]).toMatch(/^postgres:\d+\.\d+-alpine$/);
   });
 
+  it("lets a major version through only as a decision, never as an update PR", () => {
+    const dependabot = read(".github/dependabot.yml");
+    // The first run of the compose ecosystem proposed 16.15 -> 18.6. A
+    // PostgreSQL major changes the on-disk format, so it is a migration the
+    // project schedules, not an update an operator merges on a Tuesday.
+    expect(dependabot).toMatch(
+      /dependency-name:\s*"postgres"[\s\S]{0,200}version-update:semver-major/,
+    );
+  });
+
   it("is watched by the compose ecosystem, which is not the Dockerfile one", () => {
     const dependabot = read(".github/dependabot.yml");
     const ecosystems = [