diff --git a/terraform/environments/aws/dev.tfvars.example b/terraform/environments/aws/dev.tfvars.example
index 6457ebf9f..7f0128abe 100644
--- a/terraform/environments/aws/dev.tfvars.example
+++ b/terraform/environments/aws/dev.tfvars.example
@@ -47,7 +47,7 @@ fargate_max_capacity  = 10
 
 database_name            = "cudly"
 database_username        = "cudly"
-database_engine_version  = "16.6"
+database_engine_version  = "16"
 database_backup_retention_days = 7
 database_deletion_protection   = false  # Allow deletion in dev
 database_skip_final_snapshot   = true   # Skip in dev
diff --git a/terraform/environments/aws/github-dev.tfvars b/terraform/environments/aws/github-dev.tfvars
index bef905013..10b05b07f 100644
--- a/terraform/environments/aws/github-dev.tfvars
+++ b/terraform/environments/aws/github-dev.tfvars
@@ -46,7 +46,7 @@ fargate_max_capacity  = 5
 
 database_name                  = "cudly"
 database_username              = "cudly"
-database_engine_version        = "16.6"
+database_engine_version        = "16"
 database_backup_retention_days = 7
 database_deletion_protection   = false
 database_skip_final_snapshot   = true
diff --git a/terraform/environments/aws/github-prod.tfvars b/terraform/environments/aws/github-prod.tfvars
index 99470778c..447d5082d 100644
--- a/terraform/environments/aws/github-prod.tfvars
+++ b/terraform/environments/aws/github-prod.tfvars
@@ -44,7 +44,7 @@ fargate_max_capacity  = 20
 
 database_name                  = "cudly"
 database_username              = "cudly"
-database_engine_version        = "16.6"
+database_engine_version        = "16"
 database_backup_retention_days = 30
 database_deletion_protection   = true
 database_skip_final_snapshot   = false
diff --git a/terraform/environments/aws/github-staging.tfvars b/terraform/environments/aws/github-staging.tfvars
index 7e38b86d7..86068d31d 100644
--- a/terraform/environments/aws/github-staging.tfvars
+++ b/terraform/environments/aws/github-staging.tfvars
@@ -43,7 +43,7 @@ fargate_max_capacity  = 10
 
 database_name                  = "cudly"
 database_username              = "cudly"
-database_engine_version        = "16.6"
+database_engine_version        = "16"
 database_backup_retention_days = 14
 database_deletion_protection   = false
 database_skip_final_snapshot   = true
diff --git a/terraform/environments/aws/variables.tf b/terraform/environments/aws/variables.tf
index a69171c46..fd105d11c 100644
--- a/terraform/environments/aws/variables.tf
+++ b/terraform/environments/aws/variables.tf
@@ -122,9 +122,9 @@ variable "database_username" {
 }
 
 variable "database_engine_version" {
-  description = "PostgreSQL version"
+  description = "PostgreSQL major engine version (major-only pin, e.g. \"16\"). The AWS provider resolves to the latest minor release and stores it in engine_version_actual, suppressing drift when RDS auto-upgrades the minor version. Pinning a full minor version (e.g. \"16.6\") causes downgrade failures if RDS auto-upgrades beyond it (incident: 2026-07-16, #1372)."
   type        = string
-  default     = "16.6"
+  default     = "16"
 }
 
 variable "database_instance_class" {
diff --git a/terraform/modules/database/aws/main.tf b/terraform/modules/database/aws/main.tf
index 4e844dfe0..c4a269e5b 100644
--- a/terraform/modules/database/aws/main.tf
+++ b/terraform/modules/database/aws/main.tf
@@ -122,7 +122,12 @@ resource "aws_db_instance" "main" {
   engine     = "postgres"
 
   engine_version = var.engine_version
-  instance_class = var.instance_class
+  # Major-only engine_version pin: the provider stores the real minor in
+  # engine_version_actual and suppresses diff on auto-minor upgrades.
+  # auto_minor_version_upgrade must be explicitly true so the intent is
+  # self-describing (incident: 2026-07-16, #1372).
+  auto_minor_version_upgrade = true
+  instance_class             = var.instance_class
 
   db_name  = var.database_name
   username = var.master_username
diff --git a/terraform/modules/database/aws/variables.tf b/terraform/modules/database/aws/variables.tf
index 58feb3850..14935efe5 100644
--- a/terraform/modules/database/aws/variables.tf
+++ b/terraform/modules/database/aws/variables.tf
@@ -43,9 +43,9 @@ variable "create_password" {
 }
 
 variable "engine_version" {
-  description = "PostgreSQL engine version"
+  description = "PostgreSQL major engine version (major-only pin, e.g. \"16\"). The AWS provider resolves to the latest minor release and stores it in engine_version_actual, suppressing drift when RDS auto-upgrades the minor version. Pinning a full minor version (e.g. \"16.6\") causes downgrade failures if RDS auto-upgrades beyond it (incident: 2026-07-16, #1372)."
   type        = string
-  default     = "16.6"
+  default     = "16"
 }
 
 variable "instance_class" {