diff --git a/extensions.toml b/extensions.toml
index 603bf0f..4ef9d48 100644
--- a/extensions.toml
+++ b/extensions.toml
@@ -30,11 +30,11 @@ pg_trgm = "1.6"
 # 2026-06; verified via `apt-cache madison postgresql-18-<name>` against
 # apt.postgresql.org noble-pgdg). pg_cron + pg_partman are non-negotiable
 # (pg_cron: REQUIRED + shared_preload; pg_partman: queue partitioned queues).
-pgvector = "0.8.2"
+pgvector = "0.8.7"
 postgis = "3.6.4"
 pg_cron = "1.6.7"
 pg_partman = "5.4.3"
-hypopg = "1.4.2"
+hypopg = "1.4.5"
 pg_repack = "1.5.3"
 # Dropped — no PGDG build for noble+pg18 as of 2026-06 (re-add a pin once PGDG
 # ships one): pgvectorscale (no postgresql-18-pgvectorscale), pg_jsonschema (no
diff --git a/packer/scripts/03-pgdg-extensions.sh b/packer/scripts/03-pgdg-extensions.sh
index e2d09fd..28fcc12 100644
--- a/packer/scripts/03-pgdg-extensions.sh
+++ b/packer/scripts/03-pgdg-extensions.sh
@@ -16,7 +16,7 @@ pin_install() {
   full_ver=$(apt-cache madison "${pkg}" \
     | awk -F'|' '{print $2}' \
     | tr -d ' ' \
-    | grep "${upstream_ver}" \
+    | { grep -F "${upstream_ver}" || true; } \
     | head -1)
   if [[ -z "${full_ver}" ]]; then
     echo "ERROR: ${pkg} version matching '${upstream_ver}' not found in apt cache" >&2