diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index dcb0192cb..37166c593 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -207,7 +207,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres
+        image: postgres:14
         ports:
           - 4444:5432/tcp
         env:
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 81bb240ad..53fc1cb9b 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -154,7 +154,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres
+        image: postgres:14
         ports:
           - 4444:5432/tcp
         env:
diff --git a/lib/Push.php b/lib/Push.php
index 94f76484d..2204ecdbc 100644
--- a/lib/Push.php
+++ b/lib/Push.php
@@ -91,6 +91,14 @@ class Push {
 	/** @var string[] */
 	protected $loadStatusForUsers = [];
 
+	/**
+	 * A very small and privileged list of apps that are allowed to push during DND.
+	 * @var bool[]
+	 */
+	protected $allowedDNDPushList = [
+		'twofactor_nextcloud_notification' => true,
+	];
+
 	public function __construct(IDBConnection $connection,
 								INotificationManager $notificationManager,
 								IConfig $config,
@@ -226,7 +234,7 @@ public function pushToDevice(int $id, INotification $notification, ?OutputInterf
 
 		if (isset($this->userStatuses[$notification->getUser()])) {
 			$userStatus = $this->userStatuses[$notification->getUser()];
-			if ($userStatus->getStatus() === IUserStatus::DND) {
+			if ($userStatus->getStatus() === IUserStatus::DND && empty($this->allowedDNDPushList[$notification->getApp()])) {
 				$this->printInfo('<error>User status is set to DND - no push notifications will be sent</error>');
 				return;
 			}