diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1707bc4..b07fa01 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,3 +7,16 @@ updates:
       interval: "weekly"
     assignees:
       - "gmazoyer"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    assignees:
+      - "gmazoyer"
+  - package-ecosystem: "docker-compose"
+    directories:
+      - "/"
+    schedule:
+      interval: "weekly"
+    assignees:
+      - "gmazoyer"
diff --git a/Dockerfile b/Dockerfile
index 5a8e0e5..a2bbfdf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,19 +18,16 @@ RUN apk add --no-cache \
     make \
     musl-dev \
     openldap-dev \
-    py3-pip \
     python3-dev \
-    && python3 -m venv /opt/peering-manager/venv \
-    && /opt/peering-manager/venv/bin/python3 -m pip install --upgrade \
-    pip \
-    setuptools \
-    wheel
+    uv \
+    && uv venv --seed --python python3 /opt/peering-manager/venv
 
 ARG PEERING_MANAGER_PATH
 COPY ${PEERING_MANAGER_PATH}/requirements.txt requirements-container.txt /
+ENV UV_NO_CACHE=1 UV_PYTHON=/opt/peering-manager/venv/bin/python3
 RUN \
     sed -i -e 's/social-auth-core/social-auth-core\[all\]/g' /requirements.txt && \
-    /opt/peering-manager/venv/bin/pip install -r /requirements.txt -r /requirements-container.txt
+    uv pip install -r /requirements.txt -r /requirements-container.txt
 
 FROM ${FROM} AS bgpq-builder
 
diff --git a/README.md b/README.md
index f123d05..3c6f327 100644
--- a/README.md
+++ b/README.md
@@ -64,6 +64,48 @@ BASE_PATH=peering/
 The container applies the value to the URLs, to the static files and to its
 health check.
 
+## Upgrade PostgreSQL
+
+`docker-compose.yml` tracks a recent PostgreSQL release, so a `git pull` can
+move the database to a new major version. A server refuses a data directory
+that another major version wrote, so every major bump needs a dump and a
+restore.
+
+Take the dump before you pull, while the old server still runs:
+
+```shell
+docker compose exec -T postgres pg_dumpall -U peering_manager >dump.sql
+docker compose down
+docker volume ls  # find the name of the postgres volume
+docker volume rm <project>_peeringmanager-postgres-data
+git pull
+docker compose up --detach --wait postgres
+docker compose exec -T postgres psql -U peering_manager -d postgres <dump.sql
+docker compose up --detach
+```
+
+Compose puts the name of your project in front of the volume, hence the
+`docker volume ls` step.
+
+The restore reports two errors, one for the role and one for the database that
+already exist. Ignore them, because the new container creates both before the
+restore runs.
+
+To stay on your current major version, pin the image in your
+`docker-compose.override.yml`. For example, to keep PostgreSQL 17:
+
+```yaml
+services:
+  postgres:
+    image: docker.io/postgres:17-alpine
+```
+
+One extra step applies when you come from PostgreSQL 17 or older. Version 18
+keeps its data in a directory named after the major version, so
+`docker-compose.yml` mounts the volume on `/var/lib/postgresql` instead of
+`/var/lib/postgresql/data`. Copy that change if you declare the postgres
+service yourself.
+
 ## About
 
 This work is based on the great
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
index ef2ee75..b9bb6f4 100644
--- a/docker-compose.test.yml
+++ b/docker-compose.test.yml
@@ -20,7 +20,7 @@ services:
       interval: 15s
 
   postgres:
-    image: postgres:17-alpine
+    image: postgres:18-alpine
     env_file: env/postgres.env
     healthcheck:
       test: pg_isready -q -t 2 -d $$POSTGRES_DB -U $$POSTGRES_USER ## $$ because of docker-compose
@@ -30,7 +30,7 @@ services:
       retries: 5
 
   redis: &redis
-    image: docker.io/valkey/valkey:8.0-alpine
+    image: docker.io/valkey/valkey:9-alpine
     command:
     - sh
     - -c # this is to evaluate the $REDIS_PASSWORD from the env
diff --git a/docker-compose.yml b/docker-compose.yml
index b565a16..5549a1f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -26,7 +26,7 @@ services:
       - /opt/peering-manager/manage.py
       - rqworker
     healthcheck:
-      test: "ps -a | grep -v grep | grep -q rqworker || exit 1"
+      test: pgrep -f rqworker || exit 1
       start_period: 20s
       timeout: 3s
       interval: 15s
@@ -46,7 +46,7 @@ services:
       - /opt/peering-manager/run-command.sh
       - housekeeping
     healthcheck:
-      test: "ps -a | grep -v grep | grep -q housekeeping || exit 1"
+      test: pgrep -f housekeeping || exit 1
       start_period: 20s
       timeout: 3s
       interval: 15s
@@ -63,13 +63,13 @@ services:
       - /opt/peering-manager/run-command.sh
       - peeringdb_sync
     healthcheck:
-      test: "ps -a | grep -v grep | grep -q peeringdb_sync || exit 1"
+      test: pgrep -f peeringdb_sync || exit 1
       start_period: 20s
       timeout: 3s
       interval: 15s
 
   postgres:
-    image: docker.io/postgres:17-alpine
+    image: docker.io/postgres:18-alpine
     healthcheck:
       test: pg_isready -q -t 2 -d $$POSTGRES_DB -U $$POSTGRES_USER
       start_period: 20s
@@ -78,10 +78,10 @@ services:
       retries: 5
     env_file: env/postgres.env
     volumes:
-      - peeringmanager-postgres-data:/var/lib/postgresql/data
+      - peeringmanager-postgres-data:/var/lib/postgresql
 
   redis:
-    image: docker.io/valkey/valkey:8.0-alpine
+    image: docker.io/valkey/valkey:9-alpine
     command:
       - sh
       - -c # this is to evaluate the $REDIS_PASSWORD from the env
@@ -96,7 +96,7 @@ services:
     volumes:
       - peeringmanager-redis-data:/data
   redis-cache:
-    image: docker.io/valkey/valkey:8.0-alpine
+    image: docker.io/valkey/valkey:9-alpine
     command:
       - sh
       - -c # this is to evaluate the $REDIS_PASSWORD from the env
diff --git a/env/peering-manager.env b/env/peering-manager.env
index f1ffcf7..47d198b 100644
--- a/env/peering-manager.env
+++ b/env/peering-manager.env
@@ -8,8 +8,8 @@ DB_HOST=postgres
 EMAIL_FROM_ADDRESS=peering@example.com
 REDIS_HOST=redis
 REDIS_PASSWORD=VDMLLoJA8JnMLAxx
-REDIS_CACHE_HOST=redis
-REDIS_CACHE_PASSWORD=VDMLLoJA8JnMLAxx
+REDIS_CACHE_HOST=redis-cache
+REDIS_CACHE_PASSWORD=PAMOOoTG0QnMLAjj
 SKIP_SUPERUSER=false
 SUPERUSER_NAME=admin
 SUPERUSER_EMAIL=admin@bar.com