diff --git a/.rubocop.yml b/.rubocop.yml
index c0d945b70..ff1603037 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -8,6 +8,8 @@ inherit_gem: { rubocop-rails-omakase: rubocop.yml }
 #   Enabled: false
 
 AllCops:
+  TargetRubyVersion: 4.0
+  ParserEngine: parser_prism
   Exclude:
     - 'db/migrate/**/*'
     - 'db/schema*.rb'
diff --git a/.ruby-version b/.ruby-version
index 2aa513199..fcdb2e109 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.7
+4.0.0
diff --git a/Dockerfile b/Dockerfile
index babd3b6d1..99f63ed38 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,7 +8,7 @@
 # For a containerized dev environment, see Dev Containers: https://guides.rubyonrails.org/getting_started_with_devcontainer.html
 
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=4.0.0
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here
diff --git a/Dockerfile.dev b/Dockerfile.dev
index 9c20fcda5..bf87d6e8c 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=4.0.0
 FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here
diff --git a/Gemfile b/Gemfile
index 8c6d39d0f..b3473d994 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,6 +2,8 @@ source "https://rubygems.org"
 
 git_source(:bc) { |repo| "https://github.com/basecamp/#{repo}" }
 
+ruby file: ".ruby-version"
+
 gem "rails", github: "rails/rails", branch: "main"
 
 # Assets & front end
@@ -32,7 +34,7 @@ gem "lexxy", bc: "lexxy"
 gem "image_processing", "~> 1.14"
 gem "platform_agent"
 gem "aws-sdk-s3", require: false
-gem "web-push"
+gem "web-push", ">= 3.1.0"
 gem "net-http-persistent"
 gem "rubyzip", require: "zip"
 gem "mittens"
@@ -50,6 +52,7 @@ group :development, :test do
   gem "faker"
   gem "letter_opener"
   gem "rack-mini-profiler"
+  gem "rubocop", ">= 1.82.0", require: false
   gem "rubocop-rails-omakase", require: false
 end
 
@@ -62,5 +65,6 @@ group :test do
   gem "selenium-webdriver"
   gem "webmock"
   gem "vcr"
+  gem "cgi" # Indirect vcr dep removed Ruby 4.0 stdlib
   gem "mocha"
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index dd1cbc16b..93137380d 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -151,8 +151,8 @@ GEM
     brakeman (7.1.1)
       racc
     builder (3.3.0)
-    bundler-audit (0.9.2)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
       thor (~> 1.0)
     capybara (3.40.0)
       addressable
@@ -163,6 +163,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cgi (0.5.1)
     childprocess (5.1.0)
       logger (~> 1.5)
     chunky_png (1.4.0)
@@ -185,14 +186,7 @@ GEM
       tzinfo
     faker (3.5.2)
       i18n (>= 1.8.11, < 2)
-    ffi (1.17.2-aarch64-linux-gnu)
-    ffi (1.17.2-aarch64-linux-musl)
-    ffi (1.17.2-arm-linux-gnu)
-    ffi (1.17.2-arm-linux-musl)
-    ffi (1.17.2-arm64-darwin)
-    ffi (1.17.2-x86_64-darwin)
-    ffi (1.17.2-x86_64-linux-gnu)
-    ffi (1.17.2-x86_64-linux-musl)
+    ffi (1.17.2)
     fugit (1.12.1)
       et-orbi (~> 1.4)
       raabro (~> 1.4)
@@ -257,6 +251,7 @@ GEM
     mini_magick (5.3.1)
       logger
     mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
     minitest (5.26.2)
     mission_control-jobs (1.1.0)
       actioncable (>= 7.1)
@@ -289,23 +284,10 @@ GEM
       net-protocol
     net-ssh (7.3.0)
     nio4r (2.7.5)
-    nokogiri (1.18.10-aarch64-linux-gnu)
+    nokogiri (1.18.10)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.18.10-aarch64-linux-musl)
-      racc (~> 1.4)
-    nokogiri (1.18.10-arm-linux-gnu)
-      racc (~> 1.4)
-    nokogiri (1.18.10-arm-linux-musl)
-      racc (~> 1.4)
-    nokogiri (1.18.10-arm64-darwin)
-      racc (~> 1.4)
-    nokogiri (1.18.10-x86_64-darwin)
-      racc (~> 1.4)
-    nokogiri (1.18.10-x86_64-linux-gnu)
-      racc (~> 1.4)
-    nokogiri (1.18.10-x86_64-linux-musl)
-      racc (~> 1.4)
-    openssl (3.3.2)
+    openssl (4.0.0)
     ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.10.0)
@@ -317,7 +299,7 @@ GEM
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.6.0)
+    prism (1.7.0)
     propshaft (1.3.1)
       actionpack (>= 7.0.0)
       activesupport (>= 7.0.0)
@@ -359,11 +341,11 @@ GEM
       io-console (~> 0.5)
     rexml (3.4.4)
     rouge (4.6.1)
-    rqrcode (3.1.0)
+    rqrcode (3.1.1)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
-    rubocop (1.81.7)
+    rqrcode_core (2.0.1)
+    rubocop (1.82.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -371,7 +353,7 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.48.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
     rubocop-ast (1.48.0)
@@ -420,14 +402,8 @@ GEM
       fugit (~> 1.11)
       railties (>= 7.1)
       thor (>= 1.3.1)
-    sqlite3 (2.8.0-aarch64-linux-gnu)
-    sqlite3 (2.8.0-aarch64-linux-musl)
-    sqlite3 (2.8.0-arm-linux-gnu)
-    sqlite3 (2.8.0-arm-linux-musl)
-    sqlite3 (2.8.0-arm64-darwin)
-    sqlite3 (2.8.0-x86_64-darwin)
-    sqlite3 (2.8.0-x86_64-linux-gnu)
-    sqlite3 (2.8.0-x86_64-linux-musl)
+    sqlite3 (2.8.0)
+      mini_portile2 (~> 2.8.0)
     sshkit (1.24.0)
       base64
       logger
@@ -440,10 +416,6 @@ GEM
     stringio (3.1.9)
     thor (1.4.0)
     thruster (0.1.17)
-    thruster (0.1.17-aarch64-linux)
-    thruster (0.1.17-arm64-darwin)
-    thruster (0.1.17-x86_64-darwin)
-    thruster (0.1.17-x86_64-linux)
     timeout (0.4.4)
     trilogy (2.9.0)
     tsort (0.2.0)
@@ -454,7 +426,7 @@ GEM
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
     vcr (6.3.1)
       base64
@@ -463,9 +435,9 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
-    web-push (3.0.2)
+    web-push (3.1.0)
       jwt (~> 3.0)
-      openssl (~> 3.0)
+      openssl (>= 3.0)
     webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
@@ -486,7 +458,8 @@ PLATFORMS
   arm-linux-gnu
   arm-linux-musl
   arm64-darwin
-  x86_64-darwin-25
+  ruby
+  x86_64-darwin
   x86_64-linux
   x86_64-linux-gnu
   x86_64-linux-musl
@@ -500,6 +473,7 @@ DEPENDENCIES
   brakeman
   bundler-audit
   capybara
+  cgi
   debug
   faker
   geared_pagination (~> 1.2)
@@ -521,6 +495,7 @@ DEPENDENCIES
   redcarpet
   rouge
   rqrcode
+  rubocop (>= 1.82.0)
   rubocop-rails-omakase
   rubyzip
   selenium-webdriver
@@ -535,8 +510,11 @@ DEPENDENCIES
   useragent!
   vcr
   web-console
-  web-push
+  web-push (>= 3.1.0)
   webmock
 
+RUBY VERSION
+  ruby 4.0.0
+
 BUNDLED WITH
-   2.7.2
+  4.0.3
diff --git a/Gemfile.saas b/Gemfile.saas
index 05e6bbabd..28d860a58 100644
--- a/Gemfile.saas
+++ b/Gemfile.saas
@@ -9,6 +9,7 @@ gem "queenbee", bc: "queenbee-plugin"
 gem "fizzy-saas", path: "saas"
 gem "console1984", bc: "console1984"
 gem "audits1984", bc: "audits1984"
+gem "rinku", require: "rails_rinku", github: "maxprokopiev/rinku", branch: "fix-ruby-export" # FIXME: pending https://github.com/vmg/rinku/pull/97; audits1984 dependency
 
 # Telemetry
 gem "rails_structured_logging", bc: "rails-structured-logging"
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 5ea235fb5..5f30a186d 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -58,6 +58,13 @@ GIT
       rails (>= 6.1)
       yabeda (~> 0.6)
 
+GIT
+  remote: https://github.com/maxprokopiev/rinku.git
+  revision: 8583fe1c0531d2fdea6e5c120fb1b0b800b452b7
+  branch: fix-ruby-export
+  specs:
+    rinku (2.0.6)
+
 GIT
   remote: https://github.com/rails/rails.git
   revision: 4f4e0acaf558f6adf7df3ac23a51beb470463901
@@ -229,8 +236,8 @@ GEM
     brakeman (7.1.1)
       racc
     builder (3.3.0)
-    bundler-audit (0.9.2)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
       thor (~> 1.0)
     capybara (3.40.0)
       addressable
@@ -241,6 +248,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cgi (0.5.1)
     childprocess (5.1.0)
       logger (~> 1.5)
     chunky_png (1.4.0)
@@ -264,6 +272,7 @@ GEM
       tzinfo
     faker (3.5.2)
       i18n (>= 1.8.11, < 2)
+    ffi (1.17.2)
     ffi (1.17.2-aarch64-linux-gnu)
     ffi (1.17.2-aarch64-linux-musl)
     ffi (1.17.2-arm-linux-gnu)
@@ -335,6 +344,7 @@ GEM
     mini_magick (5.3.1)
       logger
     mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
     minitest (5.26.2)
     mission_control-jobs (1.1.0)
       actioncable (>= 7.1)
@@ -367,6 +377,9 @@ GEM
       net-protocol
     net-ssh (7.3.0)
     nio4r (2.7.5)
+    nokogiri (1.18.10)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
     nokogiri (1.18.10-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.18.10-aarch64-linux-musl)
@@ -381,7 +394,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.18.10-x86_64-linux-musl)
       racc (~> 1.4)
-    openssl (3.3.2)
+    openssl (4.0.0)
     ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.10.0)
@@ -393,7 +406,7 @@ GEM
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.6.0)
+    prism (1.7.0)
     prometheus-client-mmap (1.4.0)
       base64
       bigdecimal
@@ -467,13 +480,12 @@ GEM
     reline (0.6.3)
       io-console (~> 0.5)
     rexml (3.4.4)
-    rinku (2.0.6)
     rouge (4.6.1)
-    rqrcode (3.1.0)
+    rqrcode (3.1.1)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
-    rubocop (1.81.7)
+    rqrcode_core (2.0.1)
+    rubocop (1.82.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -481,7 +493,7 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.48.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
     rubocop-ast (1.48.0)
@@ -540,6 +552,8 @@ GEM
       fugit (~> 1.11)
       railties (>= 7.1)
       thor (>= 1.3.1)
+    sqlite3 (2.8.0)
+      mini_portile2 (~> 2.8.0)
     sqlite3 (2.8.0-aarch64-linux-gnu)
     sqlite3 (2.8.0-aarch64-linux-musl)
     sqlite3 (2.8.0-arm-linux-gnu)
@@ -573,7 +587,7 @@ GEM
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
     vcr (6.3.1)
       base64
@@ -582,9 +596,9 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
-    web-push (3.0.2)
+    web-push (3.1.0)
       jwt (~> 3.0)
-      openssl (~> 3.0)
+      openssl (>= 3.0)
     webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
@@ -633,6 +647,7 @@ PLATFORMS
   arm-linux-gnu
   arm-linux-musl
   arm64-darwin
+  ruby
   x86_64-linux
   x86_64-linux-gnu
   x86_64-linux-musl
@@ -648,6 +663,7 @@ DEPENDENCIES
   brakeman
   bundler-audit
   capybara
+  cgi
   console1984!
   debug
   faker
@@ -672,8 +688,10 @@ DEPENDENCIES
   rails!
   rails_structured_logging!
   redcarpet
+  rinku!
   rouge
   rqrcode
+  rubocop (>= 1.82.0)
   rubocop-rails-omakase
   rubyzip
   selenium-webdriver
@@ -691,7 +709,7 @@ DEPENDENCIES
   useragent!
   vcr
   web-console
-  web-push
+  web-push (>= 3.1.0)
   webmock
   webrick
   yabeda
@@ -703,5 +721,8 @@ DEPENDENCIES
   yabeda-puma-plugin
   yabeda-rails
 
+RUBY VERSION
+  ruby 4.0.0
+
 BUNDLED WITH
-   2.7.2
+  4.0.3
diff --git a/bin/setup b/bin/setup
index 306282cb5..a55a268d7 100755
--- a/bin/setup
+++ b/bin/setup
@@ -133,6 +133,7 @@ elif which brew >/dev/null 2>&1; then
 fi
 
 bundle config set --local auto_install true
+bundle config set --local default_cli_command install
 step "Installing RubyGems" bundle install
 
 if [ -n "$SAAS" ]; then
diff --git a/saas/Dockerfile b/saas/Dockerfile
index 92fd9c4ec..314a76aff 100644
--- a/saas/Dockerfile
+++ b/saas/Dockerfile
@@ -1,5 +1,5 @@
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=4.0.0
 FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here