diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 6080811e25..856209a6c3 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,2 +1,16 @@
-FROM mcr.microsoft.com/devcontainers/ruby:dev-3.3-bookworm
+FROM mcr.microsoft.com/devcontainers/ruby:dev-4.0-bookworm
 RUN apt-get update && apt-get install -y vim curl gpg postgresql postgresql-contrib tzdata imagemagick
+
+# The dev-4.0 tag tracks the latest Ruby 4.0.x patch, which may not match the
+# exact version pinned in .ruby-version. If it doesn't, install the pinned
+# version via rvm so Bundler is happy. When patch versions align, this is a
+# no-op and the build stays fast.
+USER vscode
+COPY --chown=vscode:vscode .ruby-version /tmp/.ruby-version
+RUN /bin/bash -lc '\
+    pinned="$(cat /tmp/.ruby-version)"; \
+    if ! ruby -v | grep -q "ruby $pinned"; then \
+      rvm install "$pinned" && rvm --default use "$pinned"; \
+    fi' \
+    && rm /tmp/.ruby-version
+USER root
diff --git a/.devcontainer/post-create.sh b/.devcontainer/post-create.sh
index 35faa0b7d5..addbd61c91 100755
--- a/.devcontainer/post-create.sh
+++ b/.devcontainer/post-create.sh
@@ -3,9 +3,9 @@ RUBY_VERSION="$(cat .ruby-version | tr -d '\n')"
 # copy the file only if it doesn't already exist
 cp -n .devcontainer/.env.codespaces .env
 
-# If the project's required ruby version changes from 4.0.2, this command
+# If the project's required ruby version changes from 4.0.3, this command
 # will download and compile the correct version, but it will take a long time.
-if [ "$RUBY_VERSION" != "4.0.2" ]; then
+if [ "$RUBY_VERSION" != "4.0.3" ]; then
 	rvm install $RUBY_VERSION
 	rvm use $RUBY_VERSION
 	echo "Ruby $RUBY_VERSION installed"
diff --git a/.ruby-version b/.ruby-version
index 4d54daddb6..c4e41f9459 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-4.0.2
+4.0.3
diff --git a/.tool-versions b/.tool-versions
index 2b58a4f8e5..9856bac315 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,2 @@
-ruby 4.0.2
+ruby 4.0.3
 nodejs 24.13.0
diff --git a/Dockerfile b/Dockerfile
index 3ea6200dbe..8d35b9135c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@ ARG ROOT=/usr/src/app/
 
 FROM node:24-alpine AS node-source
 
-FROM ruby:4.0.2-alpine AS build
+FROM ruby:4.0.3-alpine AS build
 ARG ROOT
 WORKDIR $ROOT
 
@@ -22,7 +22,7 @@ RUN bundle config set force_ruby_platform true
 COPY Gemfile* $ROOT
 RUN bundle install
 
-FROM ruby:4.0.2-alpine
+FROM ruby:4.0.3-alpine
 ARG ROOT
 WORKDIR $ROOT
 
diff --git a/Gemfile b/Gemfile
index f12fb4fad5..a5daa165da 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,7 +2,7 @@
 
 source "https://rubygems.org"
 
-ruby "4.0.2"
+ruby "4.0.3"
 gem "rails", "~> 7.2"
 
 gem "after_party" # Post-deployment tasks
diff --git a/Gemfile.lock b/Gemfile.lock
index ebf664a875..ff8edc1f16 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -802,7 +802,7 @@ DEPENDENCIES
   wicked
 
 RUBY VERSION
-  ruby 4.0.2
+  ruby 4.0.3
 
 BUNDLED WITH
-  4.0.9
+  4.0.6
diff --git a/README.md b/README.md
index 9b40dab0de..b880bb78c8 100644
--- a/README.md
+++ b/README.md
@@ -93,7 +93,7 @@ The complete [role description of a CASA volunteer](https://pgcasa.org/volunteer
 
 | Technology | Version |
 |---|---|
-| Ruby | 4.0.2 (see `.ruby-version`) |
+| Ruby | 4.0.3 (see `.ruby-version`) |
 | Rails | 7.2 |
 | PostgreSQL | 14+ |
 | Node.js | LTS/Krypton (see `.nvmrc`) |
@@ -131,7 +131,7 @@ Key libraries: [Hotwire Turbo](https://turbo.hotwired.dev/), [Stimulus](https://
 
 **Ruby**
 1. Install a ruby version manager: [rvm](https://rvm.io/) or [rbenv](https://github.com/rbenv/rbenv)
-1. when you cd into the project directory, let your version manager install the ruby version in `.ruby-version`. Right now that's Ruby 4.0.2
+1. when you cd into the project directory, let your version manager install the ruby version in `.ruby-version`. Right now that's Ruby 4.0.3
 1. `gem install bundler`
 
 **node.js**
diff --git a/bin/setup b/bin/setup
index 5e4627bb31..58603c2c6c 100755
--- a/bin/setup
+++ b/bin/setup
@@ -21,8 +21,10 @@ FileUtils.chdir APP_ROOT do
 
   puts "\n== Installing dependencies =="
   system! 'gem install foreman'
-  system! 'gem install bundler --conservative'
-  system!('bundle update --bundler --verbose')
+  # Pin bundler to a version Heroku supports for our Ruby. Match Heroku's
+  # supported Ruby/Bundler pairings as they evolve:
+  # https://devcenter.heroku.com/articles/ruby-support-reference#supported-ruby-versions
+  system! 'gem install bundler -v 4.0.6 --conservative'
   system!('bundle check') || system!('bundle install')
 
   # puts '\n== Copying sample files =='
diff --git a/doc/LINUX_SETUP.md b/doc/LINUX_SETUP.md
index f34ca0df2c..6e120da4cb 100644
--- a/doc/LINUX_SETUP.md
+++ b/doc/LINUX_SETUP.md
@@ -84,7 +84,7 @@ git clone https://github.com/rbenv/rbenv.git ~/.rbenv
 #   fetch list of ruby versions
 git clone https://github.com/rbenv/ruby-build.git "$(rbenv root)"/plugins/ruby-build
 
-rbenv install 4.0.2
+rbenv install 4.0.3
 ```
 
 If you would like RVM instead of rbenv
@@ -95,9 +95,9 @@ gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys 409B6B1796C275462A1703
 \curl -sSL https://get.rvm.io | bash
 . ./.bashrc
 rvm get head
-rvm install 4.0.2
-rvm alias create ruby 4.0.2
-rvm alias create default ruby-4.0.2
+rvm install 4.0.3
+rvm alias create ruby 4.0.3
+rvm alias create default ruby-4.0.3
 ```
 
 ```# Download the Chrome browser (for RSpec testing):
diff --git a/doc/MAC_SETUP.md b/doc/MAC_SETUP.md
index 2cd5df298e..f29027f589 100644
--- a/doc/MAC_SETUP.md
+++ b/doc/MAC_SETUP.md
@@ -56,17 +56,17 @@ Next, install the version of Ruby that this project uses. This can be found by c
 To install the appropriate ruby version, run:
 
 ```bash
-rbenv install 4.0.2
+rbenv install 4.0.3
 ```
 
-(Do not forget to switch 4.0.2 to the appropriate version)
+(Do not forget to switch 4.0.3 to the appropriate version)
 
 Finally, run:
 
 ```bash
-rbenv local 4.0.2
+rbenv local 4.0.3
 ```
-(Do not forget to switch 4.0.2 to the appropriate version)
+(Do not forget to switch 4.0.3 to the appropriate version)
 
 ## Nodejs
 
diff --git a/doc/WSL_SETUP.md b/doc/WSL_SETUP.md
index 08000015f9..f509e55191 100644
--- a/doc/WSL_SETUP.md
+++ b/doc/WSL_SETUP.md
@@ -28,7 +28,7 @@ You will need the following local tools installed:
 
 Install a ruby version manager like [rbenv](https://github.com/rbenv/rbenv#installation)
 
-  **Be sure to install the ruby version in `.ruby-version`. Right now that's Ruby 4.0.2.**
+  **Be sure to install the ruby version in `.ruby-version`. Right now that's Ruby 4.0.3.**
 
 Instructions for rbenv:
 
@@ -48,13 +48,13 @@ Instructions for rbenv:
 
 5.  **[Install Ruby](https://github.com/rbenv/rbenv#installing-ruby-versions)**
 
-      **Be sure to install the ruby version in `.ruby-version`. Right now that's Ruby 4.0.2.**
+      **Be sure to install the ruby version in `.ruby-version`. Right now that's Ruby 4.0.3.**
 
-      `rbenv install 4.0.2`
+      `rbenv install 4.0.3`
 
 6. **Set a Ruby version to finish installation and start**
 
-    `rbenv global 4.0.2` OR `rbenv local 4.0.2`
+    `rbenv global 4.0.3` OR `rbenv local 4.0.3`
 
 #### Troubleshooting
     If you are on Ubuntu in Windows Subsystem for Linux (WSL) and `rbenv install` indicates that the Ruby version is unavailable, you might be using Ubuntu's default install of `ruby-build`, which only comes with old installs of Ruby (ending before 2.6.) You should uninstall rvm and ruby-build's apt packages (`apt remove rvm ruby-build`) and install them with Git like this:
diff --git a/flake.nix b/flake.nix
index 06afa4a884..44bdeb5e9e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,7 +39,7 @@
 
         gemConfig = { };
         # See available versions here: https://github.com/bobvanderlinden/nixpkgs-ruby/blob/master/ruby/versions.json
-        ruby = pkgs."ruby-4.0.2";
+        ruby = pkgs."ruby-4.0.3";
 
         bundixcli = bundix.packages.${system}.default;
       in rec {