diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index bb44a58b..0de2b192 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,3 +1,3 @@
 # Make sure RUBY_VERSION matches the Ruby version in .tool-versions
-ARG RUBY_VERSION=3.4.10
+ARG RUBY_VERSION=4.0.6
 FROM ghcr.io/rails/devcontainer/images/ruby:$RUBY_VERSION
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 9a8eac38..e0c5fdfa 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: '3.4'
+          ruby-version: '4.0'
           bundler-cache: true
           working-directory: docs
 
diff --git a/.platform/hooks/prebuild/01_install_bundler.sh b/.platform/hooks/prebuild/01_install_bundler.sh
index 51b52530..cdc669a9 100644
--- a/.platform/hooks/prebuild/01_install_bundler.sh
+++ b/.platform/hooks/prebuild/01_install_bundler.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
 dnf remove libpq-devel -y
 dnf install postgresql17-devel -y
-gem install bundler -v 2.5.6
+# Keep in sync with BUNDLED WITH in Gemfile.lock
+gem install bundler -v 4.0.18
diff --git a/.rubocop.yml b/.rubocop.yml
index 21dc5910..8b96d638 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -1,6 +1,7 @@
 AllCops:
   NewCops: enable
-  TargetRubyVersion: 3.3
+# Minimum Ruby the app must run on (EB may deploy on 3.4; see Gemfile).
+  TargetRubyVersion: 3.4
   Exclude:
     - 'db/**/*'
     - 'config/**/*'
diff --git a/.tool-versions b/.tool-versions
index b8a27c4f..05913eae 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1 +1 @@
-ruby 3.4.10
+ruby 4.0.6
diff --git a/Dockerfile b/Dockerfile
index 7f3d9f5a..bbd80ca2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure RUBY_VERSION matches .tool-versions and satisfies the Gemfile's ruby constraint
-ARG RUBY_VERSION=3.4.10
+ARG RUBY_VERSION=4.0.6
 FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim as base
 
 # Rails app lives here
diff --git a/Gemfile b/Gemfile
index 325e916b..0ad184a2 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,6 +1,8 @@
 source 'https://rubygems.org'
 
-ruby '>= 3.3', '< 3.5'
+# Local dev and CI run Ruby 4.0 (see .tool-versions); Elastic Beanstalk may
+# deploy on a Ruby 3.4 or 4.0 platform branch, so allow both.
+ruby '>= 3.4', '< 5'
 
 # Bundle edge Rails instead: gem "rails", github: "rails/rails", branch: "main"
 gem 'rails', '~> 8.1.3'
diff --git a/Gemfile.lock b/Gemfile.lock
index 65744166..d8bf3c18 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -591,8 +591,6 @@ GEM
       railties (>= 7.1.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2026.3)
-      tzinfo (>= 1.0.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
     unicode-emoji (4.2.0)
@@ -691,4 +689,4 @@ RUBY VERSION
    ruby 3.4.10
 
 BUNDLED WITH
-   2.5.6
+   4.0.18
diff --git a/buildspec.yml b/buildspec.yml
index 414e38ea..356f513a 100644
--- a/buildspec.yml
+++ b/buildspec.yml
@@ -7,13 +7,13 @@ version: 0.2
 
 phases:
   install:
-    # This MUST match the Elastic Beanstalk platform's Ruby version.
-    # The staging environment runs the "Ruby 3.3 on Amazon Linux 2023"
-    # platform branch (currently ruby 3.3.11), so building with any other
-    # version breaks deploys. Bump this only together with an EB platform
-    # upgrade to a Ruby 3.4 branch.
+    # This MUST match the Elastic Beanstalk platform's Ruby version, since
+    # native gems compiled here must load on the EB host. The app supports
+    # deploying on a Ruby 3.4 or 4.0 AL2023 platform branch (the Gemfile
+    # allows >= 3.4, < 5). Bump this only together with an EB platform
+    # upgrade (e.g. to 4.0 when EB moves to the Ruby 4.0 branch).
     runtime-versions:
-      ruby: 3.3
+      ruby: 3.4
 
     commands:
       - echo "Installing system dependencies for build..."
diff --git a/config/boot.rb b/config/boot.rb
index 988a5ddc..f46f8e17 100644
--- a/config/boot.rb
+++ b/config/boot.rb
@@ -1,4 +1,9 @@
 ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
 
+# Surface Ruby-level deprecation warnings (off by default since Ruby 3.0) in
+# every environment so deprecated language/stdlib usage is visible everywhere:
+# development, CI, and production logs alike.
+Warning[:deprecated] = true
+
 require "bundler/setup" # Set up gems listed in the Gemfile.
 require "bootsnap/setup" # Speed up boot time by caching expensive operations.
diff --git a/config/environments/development.rb b/config/environments/development.rb
index 1db08070..2733327e 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -47,12 +47,9 @@
   config.action_mailer.default_url_options = { host: "localhost", port: 3000 }
 
   # Print deprecation notices to the Rails logger.
+  # (Ruby-level deprecation warnings are enabled globally in config/boot.rb.)
   config.active_support.deprecation = :log
 
-  # Surface Ruby-level deprecation warnings (off by default since Ruby 3.0) so
-  # deprecated language/stdlib usage is visible during local development.
-  Warning[:deprecated] = true
-
   # Raise exceptions for disallowed deprecations.
   config.active_support.disallowed_deprecation = :raise
 
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 304259f5..935282b3 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -110,8 +110,9 @@
   # the I18n.default_locale when a translation cannot be found).
   config.i18n.fallbacks = true
 
-  # Don't log any deprecations.
-  config.active_support.report_deprecations = false
+  # Log deprecations so upcoming Rails/Ruby removals surface in production logs.
+  config.active_support.report_deprecations = true
+  config.active_support.deprecation = :log
 
   # Do not dump schema after migrations.
   config.active_record.dump_schema_after_migration = false
diff --git a/config/environments/test.rb b/config/environments/test.rb
index fc177004..5a5abbf6 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -49,12 +49,9 @@
   # config.action_mailer.delivery_method = :test
 
   # Print deprecation notices to the stderr.
+  # (Ruby-level deprecation warnings are enabled globally in config/boot.rb.)
   config.active_support.deprecation = :stderr
 
-  # Surface Ruby-level deprecation warnings (off by default since Ruby 3.0) so
-  # deprecated language/stdlib usage is caught in CI and local test runs.
-  Warning[:deprecated] = true
-
   # Raise exceptions for disallowed deprecations.
   config.active_support.disallowed_deprecation = :raise
 
diff --git a/docs/developers.md b/docs/developers.md
index f1693bb2..163e926f 100644
--- a/docs/developers.md
+++ b/docs/developers.md
@@ -24,12 +24,12 @@ cd flextensions
 
 Install `mise`, such as `brew install mise` or any other ruby language manager.
 
-Either Ruby 3.3 or 3.4 will work. CI runs 3.4, but the deployed Elastic
-Beanstalk platform runs Ruby 3.3, so the app must remain compatible with
-both (the Gemfile allows `>= 3.3, < 3.5`):
+Either Ruby 3.4 or 4.0 will work. Local dev and CI run 4.0, but Elastic
+Beanstalk may deploy on a Ruby 3.4 platform branch, so the app must remain
+compatible with both (the Gemfile allows `>= 3.4, < 5`):
 
 ```
-mise use ruby@3.4
+mise use ruby@4.0
 ```
 
 ### Install dependencies: