diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml
index d935d2447..a1b3f9fea 100644
--- a/ansible/tasks/stage2-setup-postgres.yml
+++ b/ansible/tasks/stage2-setup-postgres.yml
@@ -62,17 +62,20 @@
   when:
     - stage2_nix
   block:
-    - name: Install packages from nix binary cache
+    - name: Resolve postgres profile store path
       ansible.builtin.shell: |
-        sudo -u postgres bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#{{ nix_item }}"
-      loop:
-        - "{{ psql_version }}/bin"
-        - pg_prove
-        - supabase-groonga
-        - "{{ postgresql_version }}_debug"
-        - "{{ postgresql_version }}_src"
-      loop_control:
-        loop_var: 'nix_item'
+        sudo -u postgres bash -c "
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
+          nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-profile-{{ postgresql_major_version }}
+        "
+      register: postgres_profile_path
+
+    - name: Install postgres profile from nix binary cache
+      ansible.builtin.shell: |
+        sudo -u postgres bash -c "
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
+          nix-env --set {{ postgres_profile_path.stdout }}
+        "
 
     - name: Install supascan for baseline validation
       ansible.builtin.shell: |
@@ -134,11 +137,6 @@
             - stage2_nix
             - not is_psql_15
           block:
-            - name: Install gatekeeper from nix binary cache
-              become: yes
-              shell: |
-                sudo -u postgres bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#gatekeeper"
-
             - name: Create symbolic link for linux-pam to find pam_jit_pg.so
               become: yes
               shell: |
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 33714fe21..f3b8ce40a 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -13,9 +13,9 @@ postgres_major:
 # This is the source of truth for Postgres versions used in the Dockerfiles, and
 # is used to derive image tags and base images in the release matrix.
 postgres_release:
-  postgresorioledb-17: "17.9.0.010-orioledb"
-  postgres17: "17.6.1.157"
-  postgres15: "15.14.1.157"
+  postgresorioledb-17: "17.9.0.010-orioledb-site"
+  postgres17: "17.6.1.157-site"
+  postgres15: "15.14.1.157-site"
 
 # Docker release matrix — base images built first, layered images built on top.
 # tag and base_tag are derived at build time from postgres_release via release_key.
diff --git a/nix/packages/default.nix b/nix/packages/default.nix
index c3b1ae012..3fc6b06d7 100644
--- a/nix/packages/default.nix
+++ b/nix/packages/default.nix
@@ -1,6 +1,9 @@
 { self, inputs, ... }:
 {
-  imports = [ ./postgres.nix ];
+  imports = [
+    ./postgres.nix
+    ./postgres-profile.nix
+  ];
   perSystem =
     {
       inputs',
diff --git a/nix/packages/postgres-profile.nix b/nix/packages/postgres-profile.nix
new file mode 100644
index 000000000..b20b9ac5a
--- /dev/null
+++ b/nix/packages/postgres-profile.nix
@@ -0,0 +1,33 @@
+{
+  perSystem =
+    {
+      lib,
+      pkgs,
+      self',
+      ...
+    }:
+    let
+      # Bundles everything the AMI build installs into the postgres user's nix
+      # profile (via `nix-env --set`) into a single derivation.
+      makePostgresProfile =
+        version:
+        pkgs.symlinkJoin {
+          name = "postgres-profile-${version}";
+          paths = [
+            self'.packages."psql_${version}/bin"
+            self'.packages.pg_prove
+            self'.packages.supabase-groonga
+            self'.packages."postgresql_${version}_src"
+          ]
+          ++ lib.optionals pkgs.stdenv.isLinux [ self'.packages."postgresql_${version}_debug" ]
+          ++ lib.optionals (pkgs.stdenv.isLinux && version != "15") [ self'.packages.gatekeeper ];
+        };
+    in
+    {
+      packages = {
+        postgres-profile-15 = makePostgresProfile "15";
+        postgres-profile-17 = makePostgresProfile "17";
+        postgres-profile-orioledb-17 = makePostgresProfile "orioledb-17";
+      };
+    };
+}