diff --git a/docker/ci/Dockerfile b/docker/ci/Dockerfile
index 4838d91ab473..b0163d24c812 100644
--- a/docker/ci/Dockerfile
+++ b/docker/ci/Dockerfile
@@ -6,7 +6,7 @@ ENV NODE_VERSION="22.15.0"
 ENV DEBIAN_FRONTEND=noninteractive
 ENV BUNDLE_WITHOUT="development:production:docker"
 
-ENV PGVERSION=13
+ENV PGVERSION=17
 RUN wget --quiet -O- https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - && \
   echo "deb http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" > /etc/apt/sources.list.d/pgdg.list
 
diff --git a/docker/ci/postgresql.conf b/docker/ci/postgresql.conf
index 39e33488f1ea..33d4bd9ffc35 100644
--- a/docker/ci/postgresql.conf
+++ b/docker/ci/postgresql.conf
@@ -1,4 +1,4 @@
-# DB Version: 13
+# DB Version: 17
 # OS Type: linux
 # DB Type: web
 # Total Memory (RAM): 32 GB
diff --git a/docker/dev/keycloak/docker-compose.yml b/docker/dev/keycloak/docker-compose.yml
index f089de51119d..a8cd4d2803a0 100644
--- a/docker/dev/keycloak/docker-compose.yml
+++ b/docker/dev/keycloak/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   db-keycloak:
-    image: postgres:13
+    image: postgres:17
     restart: unless-stopped
     networks:
       - external
diff --git a/docker/prod/Dockerfile b/docker/prod/Dockerfile
index e7ee31dee78f..0f554390f614 100755
--- a/docker/prod/Dockerfile
+++ b/docker/prod/Dockerfile
@@ -15,7 +15,7 @@ ENV DOCKER=1
 ENV APP_USER=app
 ENV APP_PATH=/app
 ENV APP_DATA_PATH=/var/openproject/assets
-ENV PGVERSION="13"
+ENV PGVERSION="17"
 ENV PGVERSION_CHOICES="13 15 17"
 ENV PGBIN="/usr/lib/postgresql/$PGVERSION/bin"
 ENV PATH="$PGBIN:$PATH"
diff --git a/docker/prod/entrypoint.sh b/docker/prod/entrypoint.sh
index 546c102b3dd5..231a3b2a8658 100755
--- a/docker/prod/entrypoint.sh
+++ b/docker/prod/entrypoint.sh
@@ -30,8 +30,19 @@ if [ "$(id -u)" = '0' ]; then
 	# reexport PGVERSION and PGBIN env variables according to postgres version of existing cluster (if any)
 	# this must happen in the entrypoint
 	if [ -f "$PGDATA/PG_VERSION" ]; then
-		export PGVERSION="$(cat "$PGDATA/PG_VERSION")"
+		EXISTING_PGVERSION="$(cat "$PGDATA/PG_VERSION")"
 		echo "-----> Existing PostgreSQL cluster found in $PGDATA."
+
+		# Check for version mismatch between configured and existing PostgreSQL versions
+		if [ "$PGVERSION" != "$EXISTING_PGVERSION" ]; then
+			echo "WARNING: PostgreSQL version mismatch detected!"
+			echo "Your container is configured for PostgreSQL $PGVERSION, but existing data is from PostgreSQL $EXISTING_PGVERSION."
+			echo "You need to upgrade your postgresql data before you can use it with PGVERSION=$PGVERSION in the container"
+			echo "Please see the migration guide: https://www.openproject.org/docs/installation-and-operations/misc/migration-to-postgresql17/"
+			echo "Continuing with PostgreSQL $EXISTING_PGVERSION for now..."
+		fi
+
+		export PGVERSION="$EXISTING_PGVERSION"
 	fi
 	export PGBIN="/usr/lib/postgresql/$PGVERSION/bin"
 	export PGCONF_FILE="/etc/postgresql/$PGVERSION/main/postgresql.conf"
diff --git a/docker/prod/setup/postinstall-onprem.sh b/docker/prod/setup/postinstall-onprem.sh
index 5c167b1862a5..72ee90b7dabd 100755
--- a/docker/prod/setup/postinstall-onprem.sh
+++ b/docker/prod/setup/postinstall-onprem.sh
@@ -45,6 +45,8 @@ su - postgres -c "$PGBIN/pg_ctl -D /tmp/nulldb -l /dev/null -l /tmp/nulldb/log -
 sleep 5
 
 echo "create database structure; create user structure with encrypted password 'p4ssw0rd'; grant all privileges on database structure to structure;" | su - postgres -c psql
+# since postgres 15 we need to also explictly grant the user permissions on the public schema
+echo "grant all on schema public to structure;" | su - postgres -c 'psql -d structure'
 
 # dump schema
 DATABASE_URL=postgres://structure:p4ssw0rd@127.0.0.1/structure RAILS_ENV=production bundle exec rake db:migrate db:schema:dump db:schema:cache:dump
diff --git a/docker/pullpreview/docker-compose.yml b/docker/pullpreview/docker-compose.yml
index f6a3bb409c39..9b725caa753b 100644
--- a/docker/pullpreview/docker-compose.yml
+++ b/docker/pullpreview/docker-compose.yml
@@ -45,7 +45,7 @@ services:
       - "caddy_data:/data"
 
   db:
-    image: postgres:13
+    image: postgres:17
     environment:
       POSTGRES_USER: app
       POSTGRES_PASSWORD: p4ssw0rd