diff --git a/.rubocop.yml b/.rubocop.yml
index c0d945b705..ff16030376 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -8,6 +8,8 @@ inherit_gem: { rubocop-rails-omakase: rubocop.yml }
 #   Enabled: false
 
 AllCops:
+  TargetRubyVersion: 4.0
+  ParserEngine: parser_prism
   Exclude:
     - 'db/migrate/**/*'
     - 'db/schema*.rb'
diff --git a/.ruby-version b/.ruby-version
index 2aa5131992..fcdb2e109f 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.7
+4.0.0
diff --git a/Dockerfile b/Dockerfile
index babd3b6d15..99f63ed38d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,7 +8,7 @@
 # For a containerized dev environment, see Dev Containers: https://guides.rubyonrails.org/getting_started_with_devcontainer.html
 
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=4.0.0
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here
diff --git a/Gemfile b/Gemfile
index 23b1223ce9..5875d8feee 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,6 +2,8 @@ source "https://rubygems.org"
 
 git_source(:bc) { |repo| "https://github.com/basecamp/#{repo}" }
 
+ruby file: ".ruby-version"
+
 gem "rails", github: "rails/rails", branch: "main"
 
 # Assets & front end
@@ -32,7 +34,7 @@ gem "lexxy", bc: "lexxy"
 gem "image_processing", "~> 1.14"
 gem "platform_agent"
 gem "aws-sdk-s3", require: false
-gem "web-push"
+gem "web-push", ">= 3.1.0"
 gem "net-http-persistent"
 gem "zip_kit"
 gem "mittens"
@@ -50,6 +52,7 @@ group :development, :test do
   gem "faker"
   gem "letter_opener"
   gem "rack-mini-profiler"
+  gem "rubocop", ">= 1.82.0", require: false
   gem "rubocop-rails-omakase", require: false
 end
 
@@ -62,5 +65,6 @@ group :test do
   gem "selenium-webdriver"
   gem "webmock"
   gem "vcr"
+  gem "cgi" # Indirect vcr dep removed Ruby 4.0 stdlib
   gem "mocha"
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index 86a856e371..4633bf5b64 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -164,6 +164,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cgi (0.5.1)
     childprocess (5.1.0)
       logger (~> 1.5)
     chunky_png (1.4.0)
@@ -186,14 +187,7 @@ GEM
       tzinfo
     faker (3.5.3)
       i18n (>= 1.8.11, < 2)
-    ffi (1.17.2-aarch64-linux-gnu)
-    ffi (1.17.2-aarch64-linux-musl)
-    ffi (1.17.2-arm-linux-gnu)
-    ffi (1.17.2-arm-linux-musl)
-    ffi (1.17.2-arm64-darwin)
-    ffi (1.17.2-x86_64-darwin)
-    ffi (1.17.2-x86_64-linux-gnu)
-    ffi (1.17.2-x86_64-linux-musl)
+    ffi (1.17.2)
     fugit (1.12.1)
       et-orbi (~> 1.4)
       raabro (~> 1.4)
@@ -258,6 +252,7 @@ GEM
     mini_magick (5.3.1)
       logger
     mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
     minitest (6.0.1)
       prism (~> 1.5)
     mission_control-jobs (1.1.0)
@@ -291,6 +286,9 @@ GEM
       net-protocol
     net-ssh (7.3.0)
     nio4r (2.7.5)
+    nokogiri (1.19.0)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
     nokogiri (1.19.0-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.19.0-aarch64-linux-musl)
@@ -365,7 +363,7 @@ GEM
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
     rqrcode_core (2.1.0)
-    rubocop (1.81.7)
+    rubocop (1.84.1)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -373,12 +371,12 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.48.0)
+    rubocop-ast (1.49.0)
       parser (>= 3.3.7.2)
-      prism (~> 1.4)
+      prism (~> 1.7)
     rubocop-performance (1.26.1)
       lint_roller (~> 1.1)
       rubocop (>= 1.75.0, < 2.0)
@@ -422,6 +420,8 @@ GEM
       fugit (~> 1.11)
       railties (>= 7.1)
       thor (>= 1.3.1)
+    sqlite3 (2.8.0)
+      mini_portile2 (~> 2.8.0)
     sqlite3 (2.8.0-aarch64-linux-gnu)
     sqlite3 (2.8.0-aarch64-linux-musl)
     sqlite3 (2.8.0-arm-linux-gnu)
@@ -456,7 +456,7 @@ GEM
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
     vcr (6.4.0)
     web-console (4.2.1)
@@ -488,7 +488,8 @@ PLATFORMS
   arm-linux-gnu
   arm-linux-musl
   arm64-darwin
-  x86_64-darwin-25
+  ruby
+  x86_64-darwin
   x86_64-linux
   x86_64-linux-gnu
   x86_64-linux-musl
@@ -502,6 +503,7 @@ DEPENDENCIES
   brakeman
   bundler-audit
   capybara
+  cgi
   debug
   faker
   geared_pagination (~> 1.2)
@@ -523,6 +525,7 @@ DEPENDENCIES
   redcarpet
   rouge
   rqrcode
+  rubocop (>= 1.82.0)
   rubocop-rails-omakase
   selenium-webdriver
   solid_cable (>= 3.0)
@@ -536,9 +539,12 @@ DEPENDENCIES
   useragent!
   vcr
   web-console
-  web-push
+  web-push (>= 3.1.0)
   webmock
   zip_kit
 
+RUBY VERSION
+  ruby 4.0.0
+
 BUNDLED WITH
-   2.7.2
+  4.0.3
diff --git a/Gemfile.saas b/Gemfile.saas
index e022ab6b20..a68219d363 100644
--- a/Gemfile.saas
+++ b/Gemfile.saas
@@ -9,6 +9,7 @@ gem "queenbee", bc: "queenbee-plugin"
 gem "fizzy-saas", path: "saas"
 gem "console1984", bc: "console1984"
 gem "audits1984", bc: "audits1984", branch: "flavorjones/coworker-api"
+gem "rinku", require: "rails_rinku", github: "maxprokopiev/rinku", branch: "fix-ruby-export" # FIXME: pending https://github.com/vmg/rinku/pull/97; audits1984 dependency
 
 # Telemetry
 gem "rails_structured_logging", bc: "rails-structured-logging"
diff --git a/Gemfile.saas.lock b/Gemfile.saas.lock
index 8de89e1fbd..a0481848c8 100644
--- a/Gemfile.saas.lock
+++ b/Gemfile.saas.lock
@@ -60,6 +60,13 @@ GIT
       rails (>= 6.1)
       yabeda (~> 0.6)
 
+GIT
+  remote: https://github.com/maxprokopiev/rinku.git
+  revision: 8583fe1c0531d2fdea6e5c120fb1b0b800b452b7
+  branch: fix-ruby-export
+  specs:
+    rinku (2.0.6)
+
 GIT
   remote: https://github.com/rails/rails.git
   revision: 60d92e4e7dfe923528ccdccc18820ccfe841b7b8
@@ -244,6 +251,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cgi (0.5.1)
     childprocess (5.1.0)
       logger (~> 1.5)
     chunky_png (1.4.0)
@@ -267,6 +275,7 @@ GEM
       tzinfo
     faker (3.5.3)
       i18n (>= 1.8.11, < 2)
+    ffi (1.17.2)
     ffi (1.17.2-aarch64-linux-gnu)
     ffi (1.17.2-aarch64-linux-musl)
     ffi (1.17.2-arm-linux-gnu)
@@ -338,6 +347,7 @@ GEM
     mini_magick (5.3.1)
       logger
     mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
     minitest (6.0.1)
       prism (~> 1.5)
     mission_control-jobs (1.1.0)
@@ -371,6 +381,9 @@ GEM
       net-protocol
     net-ssh (7.3.0)
     nio4r (2.7.5)
+    nokogiri (1.19.0)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
     nokogiri (1.19.0-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.19.0-aarch64-linux-musl)
@@ -471,13 +484,12 @@ GEM
     reline (0.6.3)
       io-console (~> 0.5)
     rexml (3.4.4)
-    rinku (2.0.6)
     rouge (4.7.0)
     rqrcode (3.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
     rqrcode_core (2.1.0)
-    rubocop (1.81.7)
+    rubocop (1.84.1)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -485,12 +497,12 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.48.0)
+    rubocop-ast (1.49.0)
       parser (>= 3.3.7.2)
-      prism (~> 1.4)
+      prism (~> 1.7)
     rubocop-performance (1.26.1)
       lint_roller (~> 1.1)
       rubocop (>= 1.75.0, < 2.0)
@@ -544,6 +556,8 @@ GEM
       fugit (~> 1.11)
       railties (>= 7.1)
       thor (>= 1.3.1)
+    sqlite3 (2.8.0)
+      mini_portile2 (~> 2.8.0)
     sqlite3 (2.8.0-aarch64-linux-gnu)
     sqlite3 (2.8.0-aarch64-linux-musl)
     sqlite3 (2.8.0-arm-linux-gnu)
@@ -577,7 +591,7 @@ GEM
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
     vcr (6.4.0)
     web-console (4.2.1)
@@ -637,6 +651,7 @@ PLATFORMS
   arm-linux-gnu
   arm-linux-musl
   arm64-darwin
+  ruby
   x86_64-linux
   x86_64-linux-gnu
   x86_64-linux-musl
@@ -652,6 +667,7 @@ DEPENDENCIES
   brakeman
   bundler-audit
   capybara
+  cgi
   console1984!
   debug
   faker
@@ -676,8 +692,10 @@ DEPENDENCIES
   rails!
   rails_structured_logging!
   redcarpet
+  rinku!
   rouge
   rqrcode
+  rubocop (>= 1.82.0)
   rubocop-rails-omakase
   selenium-webdriver
   sentry-rails
@@ -694,7 +712,7 @@ DEPENDENCIES
   useragent!
   vcr
   web-console
-  web-push
+  web-push (>= 3.1.0)
   webmock
   webrick
   yabeda
@@ -707,5 +725,8 @@ DEPENDENCIES
   yabeda-rails
   zip_kit
 
+RUBY VERSION
+  ruby 4.0.0
+
 BUNDLED WITH
-   2.7.2
+  4.0.3
diff --git a/bin/setup b/bin/setup
index 306282cb51..a55a268d71 100755
--- a/bin/setup
+++ b/bin/setup
@@ -133,6 +133,7 @@ elif which brew >/dev/null 2>&1; then
 fi
 
 bundle config set --local auto_install true
+bundle config set --local default_cli_command install
 step "Installing RubyGems" bundle install
 
 if [ -n "$SAAS" ]; then
diff --git a/saas/Dockerfile b/saas/Dockerfile
index 92fd9c4ec6..314a76aff0 100644
--- a/saas/Dockerfile
+++ b/saas/Dockerfile
@@ -1,5 +1,5 @@
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=4.0.0
 FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here