Even for @Configuration, @PostConstruct behaves as expected – it gets invoked after the dependencies of the class are injected. Although this is a bit confusing (together with the fact that @Configuration classes are beans), it is correct.
The problem at hand was a hidden circular dependency introduced with the help of spring-security-oauth – it’s a convoluted set of configurations that is beyond the scope of this discussion.
So, @PostConstruct can be invoked if the dependent beans are not fully initialized only in case of circular dependencies. If dependencies are supplied via setter or field injection the circular dependency is not reported, and instead incomplete beans are used.
Also something to note here is that it seems the circular dependency handling depends on the OS (which means some JVM or JRE differences).