diff --git a/system/nixos/postgresql.nix b/system/nixos/postgresql.nix
index 291f7f2..c44a0d7 100644
--- a/system/nixos/postgresql.nix
+++ b/system/nixos/postgresql.nix
@@ -1,9 +1,9 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 
 {
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_15_jit;
+    package = pkgs.postgresql_16_jit;
     enableJIT = true;
 
     enableTCPIP = true;
@@ -25,4 +25,34 @@
   };
 
   networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 5432 ];
+
+  # See: https://nixos.org/manual/nixos/unstable/#module-services-postgres-upgrading
+  environment.systemPackages = [
+    (
+      let
+        newPostgres = pkgs.postgresql_16_jit;
+      in
+      pkgs.writeScriptBin "upgrade-pg-cluster" ''
+        set -eux
+        # XXX it's perhaps advisable to stop all services that depend on postgresql
+        systemctl stop postgresql
+
+        export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+
+        export NEWBIN="${newPostgres}/bin"
+
+        export OLDDATA="${config.services.postgresql.dataDir}"
+        export OLDBIN="${config.services.postgresql.package}/bin"
+
+        install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+        cd "$NEWDATA"
+        sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
+
+        sudo -u postgres $NEWBIN/pg_upgrade \
+          --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+          --old-bindir $OLDBIN --new-bindir $NEWBIN \
+          "$@"
+      ''
+    )
+  ];
 }