diff --git a/.changeset/postgres-18.md b/.changeset/postgres-18.md
new file mode 100644
index 0000000..daf80a7
--- /dev/null
+++ b/.changeset/postgres-18.md
@@ -0,0 +1,16 @@
+---
+"seamless-cli": minor
+---
+
+Scaffold new projects on PostgreSQL 18, and run the conformance harness on it too.
+
+`seamless init` generated a stack pinned to `postgres:17` while the verify harness ran `postgres:16`.
+Both are now `postgres:18`, so what the harness certifies is the major a fresh scaffold actually
+gets.
+
+This does not touch an existing project. The image is written into each scaffold's own
+`docker-compose.yml` at generation time, so a project keeps whatever major it was scaffolded with and
+its data directory is never pulled out from under it. Only newly scaffolded projects get 18, on a
+fresh volume. Upgrading an existing project is a deliberate act: change the image in its
+`docker-compose.yml`, and dump and restore the volume, since PostgreSQL will not start against a data
+directory written by a different major.
diff --git a/src/core/images.test.ts b/src/core/images.test.ts
index 9b49a1b..ca2cde1 100644
--- a/src/core/images.test.ts
+++ b/src/core/images.test.ts
@@ -11,7 +11,7 @@ import {
 
 describe("image and version constants", () => {
   it("pins the postgres image", () => {
-    expect(POSTGRES_IMAGE).toBe("postgres:17");
+    expect(POSTGRES_IMAGE).toBe("postgres:18");
   });
 
   it("builds the auth API image tag from its version", () => {
diff --git a/src/core/images.ts b/src/core/images.ts
index eac49e3..e08659b 100644
--- a/src/core/images.ts
+++ b/src/core/images.ts
@@ -1,4 +1,7 @@
-export const POSTGRES_IMAGE = "postgres:17";
+// Baked into each scaffold's own docker-compose.yml at generation time, so a
+// bump here reaches new projects only. An existing project keeps the major it was
+// scaffolded with, and never has its data directory pulled out from under it.
+export const POSTGRES_IMAGE = "postgres:18";
 
 export const SEAMLESS_AUTH_API_VERSION = "v0.7.1";
 
diff --git a/verify/docker-compose.verify.yml b/verify/docker-compose.verify.yml
index d3e74cc..2d8a7ce 100644
--- a/verify/docker-compose.verify.yml
+++ b/verify/docker-compose.verify.yml
@@ -15,7 +15,10 @@ name: seamless-verify
 
 services:
   postgres:
-    image: postgres:16
+    # Matches POSTGRES_IMAGE in src/core/images.ts, so the harness runs the same
+    # major a fresh scaffold gets. Every run starts with `down -v`, so the volume
+    # is always new and a major bump needs no migration here.
+    image: postgres:18
     environment:
       POSTGRES_USER: seamless
       POSTGRES_PASSWORD: seamless