diff --git a/CLAUDE.md b/CLAUDE.md
index 187674c..5b0dc08 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -26,7 +26,7 @@ go test -v ./...
 ```
 
 - Tests use `testify` (`assert`/`require`).
-- Postgres store tests spin up a `postgres:14` container via `ory/dockertest` (`database/postgres/test`), so Docker must be running for the full suite. Memory store tests need nothing.
+- Postgres store tests spin up a `postgres:18` container via `ory/dockertest` (`database/postgres/test`), so Docker must be running for the full suite. Memory store tests need nothing.
 - Some stores (currency exchange/reserve/holder, messaging) are DynamoDB-backed; their tests use `database/dynamodb/test`.
 
 ### Building
diff --git a/database/postgres/client.go b/database/postgres/client.go
index 4421025..a71c5f2 100644
--- a/database/postgres/client.go
+++ b/database/postgres/client.go
@@ -62,11 +62,11 @@ func NewWithUsernameAndPassword(username, password, hostname, port, dbname strin
 	// IMPORTANT: Supported by Aurora Serverless clusters
 
 	// Use password based authentication
-	dsn := fmt.Sprintf("postgres://%s:%s@%s:%s/%s?sslmode=disable",
+	dsn := fmt.Sprintf("postgres://%s:%s@%s:%s/%s?sslmode=prefer",
 		username, password, hostname, port, dbname,
 	)
 
-	// TODO: either switch to IAM (non-serverless only) or enable SSL (download the db cert)
+	// TODO: either switch to IAM (non-serverless only) or use sslmode=verify-full (download the db cert)
 	// (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Security.html)
 
 	// Try to open a connection pool using the "pgx" driver (instead of "postgres")
diff --git a/database/postgres/test/util.go b/database/postgres/test/util.go
index e3cb875..8dcb6bd 100644
--- a/database/postgres/test/util.go
+++ b/database/postgres/test/util.go
@@ -18,7 +18,7 @@ import (
 
 const (
 	containerName     = "postgres"
-	containerVersion  = "14.24"
+	containerVersion  = "18.6"
 	containerAutoKill = 120 // seconds
 
 	port     = 5432