diff --git a/ansible/tasks/setup-system.yml b/ansible/tasks/setup-system.yml
index 8b961516aa..8af584ea8c 100644
--- a/ansible/tasks/setup-system.yml
+++ b/ansible/tasks/setup-system.yml
@@ -93,6 +93,25 @@
   when:
     - nixpkg_mode or stage2_nix
 
+- name: Disable algif_aead module autoload for Copy Fail mitigation
+  ansible.builtin.copy:
+    content: |
+      install algif_aead /bin/false
+    dest: /etc/modprobe.d/supabase-disable-algif_aead.conf
+    mode: '0644'
+    owner: root
+    group: root
+  when:
+    - nixpkg_mode or stage2_nix
+
+- name: Unload algif_aead module if currently loaded
+  ansible.builtin.command:
+    cmd: rmmod algif_aead
+  changed_when: false
+  failed_when: false
+  when:
+    - nixpkg_mode or stage2_nix
+
 - name: Execute more tasks when nixpkg_mode
   when:
     - nixpkg_mode
diff --git a/ansible/vars.yml b/ansible/vars.yml
index eee7137789..c54fcd791d 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -10,9 +10,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.9.0.002-orioledb"
-  postgres17: "17.6.1.149"
-  postgres15: "15.14.1.149"
+  postgresorioledb-17: "17.9.0.003-orioledb"
+  postgres17: "17.6.1.150"
+  postgres15: "15.14.1.150"
 
 # Non Postgres Extensions
 pgbouncer_release: 1.25.1
diff --git a/testinfra/test_ami_nix.py b/testinfra/test_ami_nix.py
index 084512e3de..091e0c22f1 100644
--- a/testinfra/test_ami_nix.py
+++ b/testinfra/test_ami_nix.py
@@ -1072,6 +1072,34 @@ def test_postgrest_read_only_session_attrs(host):
             print("Warning: Failed to restore PostgreSQL configuration")
 
 
+def test_copy_fail_algif_aead_mitigation(host):
+    """Verify algif_aead is blocked from autoloading and is not loaded."""
+    result = run_ssh_command(
+        host["ssh"],
+        "grep -R '^install algif_aead /bin/false$' /etc/modprobe.d /usr/lib/modprobe.d",
+    )
+    assert result["succeeded"], (
+        "algif_aead module autoload is not disabled by modprobe config.\n"
+        f"stdout: {result['stdout']}\nstderr: {result['stderr']}"
+    )
+
+    result = run_ssh_command(
+        host["ssh"],
+        "grep -qE '^algif_aead ' /proc/modules",
+    )
+    assert not result["succeeded"], "algif_aead module is loaded"
+
+    result = run_ssh_command(
+        host["ssh"],
+        "sudo modprobe -n -v algif_aead 2>&1",
+    )
+    assert result["succeeded"], f"modprobe dry-run failed: {result['stderr']}"
+    assert "install /bin/false" in result["stdout"], (
+        "modprobe dry-run did not resolve algif_aead to /bin/false.\n"
+        f"stdout: {result['stdout']}"
+    )
+
+
 def test_apparmor_postgresql_service_uses_profile(host):
     """Verify the PostgreSQL systemd service is running under the sbpostgres AppArmor profile."""
     result = run_ssh_command(