diff --git a/.rubocop.yml b/.rubocop.yml
index c0d945b705..ff16030376 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -8,6 +8,8 @@ inherit_gem: { rubocop-rails-omakase: rubocop.yml }
 #   Enabled: false
 
 AllCops:
+  TargetRubyVersion: 4.0
+  ParserEngine: parser_prism
   Exclude:
     - 'db/migrate/**/*'
     - 'db/schema*.rb'
diff --git a/.ruby-version b/.ruby-version
index 2aa5131992..fcdb2e109f 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.7
+4.0.0
diff --git a/Dockerfile b/Dockerfile
index babd3b6d15..99f63ed38d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,7 +8,7 @@
 # For a containerized dev environment, see Dev Containers: https://guides.rubyonrails.org/getting_started_with_devcontainer.html
 
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=4.0.0
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here
diff --git a/Gemfile b/Gemfile
index 8c6d39d0fd..b3473d9943 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,6 +2,8 @@ source "https://rubygems.org"
 
 git_source(:bc) { |repo| "https://github.com/basecamp/#{repo}" }
 
+ruby file: ".ruby-version"
+
 gem "rails", github: "rails/rails", branch: "main"
 
 # Assets & front end
@@ -32,7 +34,7 @@ gem "lexxy", bc: "lexxy"
 gem "image_processing", "~> 1.14"
 gem "platform_agent"
 gem "aws-sdk-s3", require: false
-gem "web-push"
+gem "web-push", ">= 3.1.0"
 gem "net-http-persistent"
 gem "rubyzip", require: "zip"
 gem "mittens"
@@ -50,6 +52,7 @@ group :development, :test do
   gem "faker"
   gem "letter_opener"
   gem "rack-mini-profiler"
+  gem "rubocop", ">= 1.82.0", require: false
   gem "rubocop-rails-omakase", require: false
 end
 
@@ -62,5 +65,6 @@ group :test do
   gem "selenium-webdriver"
   gem "webmock"
   gem "vcr"
+  gem "cgi" # Indirect vcr dep removed Ruby 4.0 stdlib
   gem "mocha"
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index 4b3ce6e445..e1d51bebea 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -152,8 +152,8 @@ GEM
     brakeman (7.1.1)
       racc
     builder (3.3.0)
-    bundler-audit (0.9.2)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
       thor (~> 1.0)
     capybara (3.40.0)
       addressable
@@ -164,6 +164,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cgi (0.5.1)
     childprocess (5.1.0)
       logger (~> 1.5)
     chunky_png (1.4.0)
@@ -186,14 +187,7 @@ GEM
       tzinfo
     faker (3.5.2)
       i18n (>= 1.8.11, < 2)
-    ffi (1.17.2-aarch64-linux-gnu)
-    ffi (1.17.2-aarch64-linux-musl)
-    ffi (1.17.2-arm-linux-gnu)
-    ffi (1.17.2-arm-linux-musl)
-    ffi (1.17.2-arm64-darwin)
-    ffi (1.17.2-x86_64-darwin)
-    ffi (1.17.2-x86_64-linux-gnu)
-    ffi (1.17.2-x86_64-linux-musl)
+    ffi (1.17.2)
     fugit (1.12.1)
       et-orbi (~> 1.4)
       raabro (~> 1.4)
@@ -258,6 +252,7 @@ GEM
     mini_magick (5.3.1)
       logger
     mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
     minitest (6.0.1)
       prism (~> 1.5)
     mission_control-jobs (1.1.0)
@@ -308,6 +303,7 @@ GEM
     nokogiri (1.19.0-x86_64-linux-musl)
       racc (~> 1.4)
     openssl (3.3.2)
+    openssl (4.0.0)
     ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.10.0)
@@ -319,7 +315,7 @@ GEM
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.6.0)
+    prism (1.7.0)
     propshaft (1.3.1)
       actionpack (>= 7.0.0)
       activesupport (>= 7.0.0)
@@ -361,11 +357,11 @@ GEM
       io-console (~> 0.5)
     rexml (3.4.4)
     rouge (4.6.1)
-    rqrcode (3.1.0)
+    rqrcode (3.1.1)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
-    rubocop (1.81.7)
+    rqrcode_core (2.0.1)
+    rubocop (1.82.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -373,7 +369,7 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.48.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
     rubocop-ast (1.48.0)
@@ -422,14 +418,8 @@ GEM
       fugit (~> 1.11)
       railties (>= 7.1)
       thor (>= 1.3.1)
-    sqlite3 (2.8.0-aarch64-linux-gnu)
-    sqlite3 (2.8.0-aarch64-linux-musl)
-    sqlite3 (2.8.0-arm-linux-gnu)
-    sqlite3 (2.8.0-arm-linux-musl)
-    sqlite3 (2.8.0-arm64-darwin)
-    sqlite3 (2.8.0-x86_64-darwin)
-    sqlite3 (2.8.0-x86_64-linux-gnu)
-    sqlite3 (2.8.0-x86_64-linux-musl)
+    sqlite3 (2.8.0)
+      mini_portile2 (~> 2.8.0)
     sshkit (1.24.0)
       base64
       logger
@@ -456,7 +446,7 @@ GEM
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
     vcr (6.3.1)
       base64
@@ -465,9 +455,9 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
-    web-push (3.0.2)
+    web-push (3.1.0)
       jwt (~> 3.0)
-      openssl (~> 3.0)
+      openssl (>= 3.0)
     webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
@@ -488,7 +478,8 @@ PLATFORMS
   arm-linux-gnu
   arm-linux-musl
   arm64-darwin
-  x86_64-darwin-25
+  ruby
+  x86_64-darwin
   x86_64-linux
   x86_64-linux-gnu
   x86_64-linux-musl
@@ -502,6 +493,7 @@ DEPENDENCIES
   brakeman
   bundler-audit
   capybara
+  cgi
   debug
   faker
   geared_pagination (~> 1.2)
@@ -523,6 +515,7 @@ DEPENDENCIES
   redcarpet
   rouge
   rqrcode
+  rubocop (>= 1.82.0)
   rubocop-rails-omakase
   rubyzip
   selenium-webdriver
@@ -537,8 +530,11 @@ DEPENDENCIES
   useragent!
   vcr
   web-console
-  web-push
+  web-push (>= 3.1.0)
   webmock
 
+RUBY VERSION
+  ruby 4.0.0
+
 BUNDLED WITH
-   2.7.2
+  4.0.3
diff --git a/Gemfile.saas b/Gemfile.saas
index 05e6bbabdf..28d860a580 100644
--- a/Gemfile.saas
+++ b/Gemfile.saas
@@ -9,6 +9,7 @@ gem "queenbee", bc: "queenbee-plugin"
 gem "fizzy-saas", path: "saas"
 gem "console1984", bc: "console1984"
 gem "audits1984", bc: "audits1984"
+gem "rinku", require: "rails_rinku", github: "maxprokopiev/rinku", branch: "fix-ruby-export" # FIXME: pending https://github.com/vmg/rinku/pull/97; audits1984 dependency
 
 # Telemetry
 gem "rails_structured_logging", bc: "rails-structured-logging"
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 98cf833bc3..a7f902bcac 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -58,6 +58,13 @@ GIT
       rails (>= 6.1)
       yabeda (~> 0.6)
 
+GIT
+  remote: https://github.com/maxprokopiev/rinku.git
+  revision: 8583fe1c0531d2fdea6e5c120fb1b0b800b452b7
+  branch: fix-ruby-export
+  specs:
+    rinku (2.0.6)
+
 GIT
   remote: https://github.com/rails/rails.git
   revision: 60d92e4e7dfe923528ccdccc18820ccfe841b7b8
@@ -230,8 +237,8 @@ GEM
     brakeman (7.1.1)
       racc
     builder (3.3.0)
-    bundler-audit (0.9.2)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
       thor (~> 1.0)
     capybara (3.40.0)
       addressable
@@ -242,6 +249,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cgi (0.5.1)
     childprocess (5.1.0)
       logger (~> 1.5)
     chunky_png (1.4.0)
@@ -265,6 +273,7 @@ GEM
       tzinfo
     faker (3.5.2)
       i18n (>= 1.8.11, < 2)
+    ffi (1.17.2)
     ffi (1.17.2-aarch64-linux-gnu)
     ffi (1.17.2-aarch64-linux-musl)
     ffi (1.17.2-arm-linux-gnu)
@@ -336,6 +345,7 @@ GEM
     mini_magick (5.3.1)
       logger
     mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
     minitest (6.0.1)
       prism (~> 1.5)
     mission_control-jobs (1.1.0)
@@ -383,7 +393,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.0-x86_64-linux-musl)
       racc (~> 1.4)
-    openssl (3.3.2)
+    openssl (4.0.0)
     ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.10.0)
@@ -395,7 +405,7 @@ GEM
     pp (0.6.3)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.6.0)
+    prism (1.7.0)
     prometheus-client-mmap (1.4.0)
       base64
       bigdecimal
@@ -469,13 +479,12 @@ GEM
     reline (0.6.3)
       io-console (~> 0.5)
     rexml (3.4.4)
-    rinku (2.0.6)
     rouge (4.6.1)
-    rqrcode (3.1.0)
+    rqrcode (3.1.1)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
-    rubocop (1.81.7)
+    rqrcode_core (2.0.1)
+    rubocop (1.82.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -483,7 +492,7 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.48.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
     rubocop-ast (1.48.0)
@@ -542,6 +551,8 @@ GEM
       fugit (~> 1.11)
       railties (>= 7.1)
       thor (>= 1.3.1)
+    sqlite3 (2.8.0)
+      mini_portile2 (~> 2.8.0)
     sqlite3 (2.8.0-aarch64-linux-gnu)
     sqlite3 (2.8.0-aarch64-linux-musl)
     sqlite3 (2.8.0-arm-linux-gnu)
@@ -575,7 +586,7 @@ GEM
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
     vcr (6.3.1)
       base64
@@ -584,9 +595,9 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
-    web-push (3.0.2)
+    web-push (3.1.0)
       jwt (~> 3.0)
-      openssl (~> 3.0)
+      openssl (>= 3.0)
     webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
@@ -635,6 +646,7 @@ PLATFORMS
   arm-linux-gnu
   arm-linux-musl
   arm64-darwin
+  ruby
   x86_64-linux
   x86_64-linux-gnu
   x86_64-linux-musl
@@ -650,6 +662,7 @@ DEPENDENCIES
   brakeman
   bundler-audit
   capybara
+  cgi
   console1984!
   debug
   faker
@@ -674,8 +687,10 @@ DEPENDENCIES
   rails!
   rails_structured_logging!
   redcarpet
+  rinku!
   rouge
   rqrcode
+  rubocop (>= 1.82.0)
   rubocop-rails-omakase
   rubyzip
   selenium-webdriver
@@ -693,7 +708,7 @@ DEPENDENCIES
   useragent!
   vcr
   web-console
-  web-push
+  web-push (>= 3.1.0)
   webmock
   webrick
   yabeda
@@ -705,5 +720,8 @@ DEPENDENCIES
   yabeda-puma-plugin
   yabeda-rails
 
+RUBY VERSION
+  ruby 4.0.0
+
 BUNDLED WITH
-   2.7.2
+  4.0.3
diff --git a/bin/setup b/bin/setup
index 306282cb51..a55a268d71 100755
--- a/bin/setup
+++ b/bin/setup
@@ -133,6 +133,7 @@ elif which brew >/dev/null 2>&1; then
 fi
 
 bundle config set --local auto_install true
+bundle config set --local default_cli_command install
 step "Installing RubyGems" bundle install
 
 if [ -n "$SAAS" ]; then
diff --git a/saas/Dockerfile b/saas/Dockerfile
index 92fd9c4ec6..314a76aff0 100644
--- a/saas/Dockerfile
+++ b/saas/Dockerfile
@@ -1,5 +1,5 @@
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=4.0.0
 FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here