diff --git a/hack/helm_vars/postgresql/values.yaml.gotmpl b/hack/helm_vars/postgresql/values.yaml.gotmpl
index f6a9456280f..80c4f34a8b1 100644
--- a/hack/helm_vars/postgresql/values.yaml.gotmpl
+++ b/hack/helm_vars/postgresql/values.yaml.gotmpl
@@ -1,12 +1,21 @@
-auth:
-  postgresPassword: "posty-the-gres"
-  username: wire-server
-  password: "posty-the-gres"
-primary:
+version:
+  postgresql: "17"
+cluster:
+  instances: 1
+  storage:
+    size: 8Gi
+    storageClass: {{ .Values.storageClass }}
   resources:
     requests:
       cpu: 1
       memory: 2Gi
-    limits: {}
-  extendedConfiguration: |
-    max_connections = 1500
+  monitoring:
+    enabled: false
+  postgresql:
+    parameters:
+      max_connections: "1500"
+  initdb:
+    database: wire-server
+    owner: dbadmin
+backups:
+  enabled: false
diff --git a/hack/helm_vars/wire-server/values.yaml.gotmpl b/hack/helm_vars/wire-server/values.yaml.gotmpl
index d3922380f9d..17417de394f 100644
--- a/hack/helm_vars/wire-server/values.yaml.gotmpl
+++ b/hack/helm_vars/wire-server/values.yaml.gotmpl
@@ -63,7 +63,7 @@ brig:
           key: "ca.crt"
     {{- end }}
     postgresql:
-      host: "postgresql"
+      host: "postgresql-rw"
       port: "5432"
       user: wire-server
       dbname: wire-server
@@ -288,7 +288,7 @@ galley:
           key: "ca.crt"
     {{- end }}
     postgresql:
-      host: postgresql
+      host: postgresql-rw
       port: "5432"
       user: wire-server
       dbname: wire-server
@@ -641,7 +641,7 @@ background-worker:
       pushBackoffMaxWait: 500000 # 0.5s
       remotesRefreshInterval: 1000000 # 1s
     postgresql:
-      host: "postgresql"
+      host: "postgresql-rw"
       port: "5432"
       user: wire-server
       dbname: wire-server
diff --git a/hack/helmfile.yaml.gotmpl b/hack/helmfile.yaml.gotmpl
index bb1bedad9bc..210f42d94a8 100644
--- a/hack/helmfile.yaml.gotmpl
+++ b/hack/helmfile.yaml.gotmpl
@@ -95,6 +95,9 @@ repositories:
   - name: groundhog2k
     url: https://groundhog2k.github.io/helm-charts
 
+  - name: cnpg
+    url: https://cloudnative-pg.github.io/charts
+
 releases:
   - name: 'fake-aws'
     namespace: '{{ .Values.namespace1 }}'
@@ -162,37 +165,35 @@ releases:
 
   - name: "postgresql"
     namespace: "{{ .Values.namespace1 }}"
-    chart: "bitnami/postgresql"
+    chart: "cnpg/cluster"
     values:
-      - './helm_vars/bitnami.yaml'
       - './helm_vars/postgresql/values.yaml.gotmpl'
-      - primary:
+      - cluster:
           initdb:
-            scripts:
-              init.sql: |
-                CREATE DATABASE "wire-server";
-                CREATE DATABASE "dyn-1";
-                CREATE DATABASE "dyn-2";
-                CREATE DATABASE "dyn-3";
-
-                GRANT ALL PRIVILEGES ON DATABASE "wire-server" TO "wire-server";
-                GRANT ALL PRIVILEGES ON DATABASE "dyn-1" TO "wire-server";
-                GRANT ALL PRIVILEGES ON DATABASE "dyn-2" TO "wire-server";
-                GRANT ALL PRIVILEGES ON DATABASE "dyn-3" TO "wire-server";
+            postInitSQL:
+              - CREATE ROLE "wire-server" WITH LOGIN PASSWORD 'posty-the-gres'
+              - CREATE DATABASE "dyn-1"
+              - CREATE DATABASE "dyn-2"
+              - CREATE DATABASE "dyn-3"
+              - GRANT ALL PRIVILEGES ON DATABASE "dyn-1" TO "wire-server"
+              - GRANT ALL PRIVILEGES ON DATABASE "dyn-2" TO "wire-server"
+              - GRANT ALL PRIVILEGES ON DATABASE "dyn-3" TO "wire-server"
+            postInitApplicationSQL:
+              - GRANT ALL PRIVILEGES ON DATABASE "wire-server" TO "wire-server"
+              - GRANT ALL ON SCHEMA public TO "wire-server"
 
   - name: "postgresql"
     namespace: "{{ .Values.namespace2 }}"
-    chart: "bitnami/postgresql"
+    chart: "cnpg/cluster"
     values:
-      - './helm_vars/bitnami.yaml'
       - './helm_vars/postgresql/values.yaml.gotmpl'
-      - primary:
+      - cluster:
           initdb:
-            scripts:
-              init.sql: |
-                CREATE DATABASE "wire-server";
-
-                GRANT ALL PRIVILEGES ON DATABASE "wire-server" TO "wire-server";
+            postInitSQL:
+              - CREATE ROLE "wire-server" WITH LOGIN PASSWORD 'posty-the-gres'
+            postInitApplicationSQL:
+              - GRANT ALL PRIVILEGES ON DATABASE "wire-server" TO "wire-server"
+              - GRANT ALL ON SCHEMA public TO "wire-server"
 
   - name: 'opensearch-ephemeral'
     namespace: '{{ .Values.namespace1 }}'