diff --git a/terraform/README.md b/terraform/README.md
index 312d9bc..a25b443 100644
--- a/terraform/README.md
+++ b/terraform/README.md
@@ -3,7 +3,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.12 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.16.0 |
 | <a name="requirement_postgresql"></a> [postgresql](#requirement\_postgresql) | 1.25.0 |
 
 ## Providers
diff --git a/terraform/backend.tf b/terraform/backend.tf
index 6873d98..6977faa 100644
--- a/terraform/backend.tf
+++ b/terraform/backend.tf
@@ -1,5 +1,9 @@
 terraform {
-  required_version = "~> 1.12"
+  # Pins major and minor; patch releases are still picked up. A two-part
+  # constraint like "~> 1.12" allows every 1.x, which is how CI drifted from
+  # 1.12 to 1.16 unnoticed. The dflook plan/apply actions resolve this to the
+  # latest matching release, so this line alone chooses the CI Terraform version.
+  required_version = "~> 1.16.0"
   backend "s3" {
   }
   required_providers {