diff --git a/.gitignore b/.gitignore
index 7edb96f06..a9bdb18d5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,6 +34,9 @@ custom_app_settings.py
 *.custom.yml
 urls_custom.py
 
+# Postgres secret files (not required for dev)
+conf/postgres/*.secret
+
 # Makefile var
 cms_name.var
 
diff --git a/AGENTS.md b/AGENTS.md
index bf336adb1..70ecd2245 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -37,6 +37,8 @@ DJANGO_SUPERUSER_PASSWORD=yourpass make setup
 - **Settings files** are gitignored. Created from `*.example.py` by `bin/setup-cms.sh` or manually.
 - The `secrets.py` Elasticsearch host should be `core_cms_elasticsearch` (the Docker hostname), not `elasticsearch`.
 - Docker commands may need `sudo` depending on the environment.
+- **Elasticsearch cgroups v2:** ES 7.17.0 crashes on kernels with cgroups v2 (`CgroupV2Subsystem` NPE). Use ES 7.17.9+ in `docker-compose.dev.yml`.
+- **Postgres secret files:** `docker-compose.dev.yml` mounts `./conf/postgres/*.secret` files. These are not required for development and can be ignored.
 
 ### Lint, test, build
 
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 0fddf6523..eaaf3a8f9 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -30,7 +30,7 @@ services:
       - core_cms_net
 
   elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.0
+    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.9
     ulimits:
       memlock: -1
     environment:
diff --git a/docker-compose.example-cms.yml b/docker-compose.example-cms.yml
index 45b5e0849..0e4da1760 100644
--- a/docker-compose.example-cms.yml
+++ b/docker-compose.example-cms.yml
@@ -30,7 +30,7 @@ services:
       - core_cms_net
 
   elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.0
+    image: docker.elastic.co/elasticsearch/elasticsearch:7.17.9
     ulimits:
       memlock: -1
     environment: