diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 9204e9192b..0000000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Check merge requirements
-
-on:
-  pull_request:
-  merge_group:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  check-release-version:
-    timeout-minutes: 5
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-
-      - name: Load postgres_release values
-        id: load_postgres_release
-        uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8 # v4.50.1
-        with:
-          args: eval '.postgres_release' ansible/vars.yml
-        # The output will be available as steps.load_postgres_release.outputs.stdout
-
-      - name: Run checks
-        run: |
-          POSTGRES_RELEASES="${{ steps.load_postgres_release.outputs.stdout }}"
-
-          # Iterate through each release
-          for release in $(echo "$POSTGRES_RELEASES" | yq eval 'keys | .[]' -); do
-            VERSION=$(echo "$POSTGRES_RELEASES" | yq eval ".\"$release\"" -)
-            if [[ "$release" == "postgresorioledb-17" ]]; then
-              # Check for suffix after -orioledb
-              if [[ "$VERSION" =~ -orioledb(.*) ]]; then
-                SUFFIX="${BASH_REMATCH[1]}"
-                if [[ -n "$SUFFIX" ]]; then
-                  echo "We no longer allow merging versions with suffixes after -orioledb."
-                  exit 1
-                fi
-              fi
-            else
-              # Check for suffix after version digits
-              if [[ "$VERSION" =~ ([0-9]+\.[0-9]+\.[0-9]+)(.*) ]]; then
-                SUFFIX="${BASH_REMATCH[2]}"
-                if [[ -n "$SUFFIX" ]]; then
-                  echo "We no longer allow merging versions with suffixes after version $VERSION."
-                  exit 1
-                fi
-              fi
-            fi
-          done
diff --git a/ansible/vars.yml b/ansible/vars.yml
index dcc71021b3..e6add0e567 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -7,9 +7,9 @@ postgres_major:
   - "17"
   - orioledb-17
 postgres_release:
-  postgresorioledb-17: "17.9.0.028-orioledb"
-  postgres17: "17.6.1.175"
   postgres15: "15.14.1.175"
+  postgres17: "17.6.1.175"
+  postgresorioledb-17: "17.9.0.028-orioledb"
 supabase_admin_agent_splay: 30s
 ###############################################################################################################
 # The following block of yaml is for get_url and co throughout the playbook                                   #
diff --git a/nix/hooks.nix b/nix/hooks.nix
index ac8ed72a60..6134dd7311 100644
--- a/nix/hooks.nix
+++ b/nix/hooks.nix
@@ -29,21 +29,47 @@ in
               settings.configPath = "ansible/ansible-lint.yaml";
               verbose = true;
             };
-            no-cli-in-postgres-release = {
+            versioning-scheme = {
               enable = true;
-              name = "no-cli-in-postgres-release";
-              description = "Prevent -cli suffix in postgres_release values in ansible/vars.yml";
-              entry = builtins.toString (
-                pkgs.writeShellScript "no-cli-in-postgres-release" ''
-                  if [ -f ansible/vars.yml ]; then
-                    if ${pkgs.gnugrep}/bin/grep -E '^\s+postgres(orioledb-)?[0-9]+:.*-cli' ansible/vars.yml; then
-                      echo ""
-                      echo "ERROR: postgres_release values in ansible/vars.yml must not contain '-cli' suffix."
-                      echo "The -cli tag is generated automatically by the AMI release workflow."
-                      exit 1
-                    fi
-                  fi
-                ''
+              name = "versioning-scheme";
+              description = "Ensure postgres_release versions match versioning scheme";
+              entry = pkgs.lib.getExe (
+                pkgs.writeShellApplication {
+                  name = "versioning-scheme";
+                  runtimeInputs = with pkgs; [
+                    yq-go
+                  ];
+                  text = ''
+                    exit_code=0
+                    while read -r supa _ version; do
+                      err() { echo "ERROR: postgres_release.$supa=$version is invalid," "$*" >&2; exit_code=1; }
+
+                      flavor=''${supa#postgres*}
+                      major=''${flavor#*-}
+
+                      if [[ $version == *orioledb* ]] && [[ $flavor != orioledb-* ]]; then
+                        err "must not contain orioledb for non-orioledb PGs"
+                        continue
+                      fi
+                      if [[ $version == *-cli ]]; then
+                        err "must not contain -cli suffix"
+                        continue
+                      fi
+
+                      re=^$major
+                      re+='(\.[0-9]+){3}'
+                      if [[ $flavor == orioledb-* ]]; then
+                        re+=-orioledb
+                      fi
+                      re+='(-[0-9a-zA-Z_-]+)?$'
+
+                      if ! [[ $version =~ $re ]]; then
+                        err "does not match $re"
+                      fi
+                    done < <(yq -o props '.postgres_release' ansible/vars.yml)
+                    exit $exit_code
+                  '';
+                }
               );
               files = "^ansible/vars\\.yml$";
               language = "system";