diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3853c16..8b29de2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -23,9 +23,9 @@ updates:
       exclude:
         - "brakeman"
 
-  - package-ecosystem: docker
-    directory: "/"
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
+  # No docker ecosystem. Our base image tag is a build arg
+  # (`FROM ruby:$RUBY_VERSION-slim`), which the updater cannot read, so the
+  # entry only ever matched nothing — worse than no entry, because it looked
+  # like coverage. Ruby base image bumps are a manual, reviewed step here, as
+  # they are across the rest of the fleet. Keep Dockerfile, Dockerfile-export
+  # and .ruby-version on the same version by hand.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index babda7d..650ffd9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: .ruby-version
           bundler-cache: true
@@ -87,7 +87,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         env:
           REDIS_URL: redis://localhost:6379/0
         with:
@@ -117,7 +117,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         env:
           REDIS_URL: redis://localhost:6379/0
         with:
diff --git a/.ruby-version b/.ruby-version
index 4f5e697..84d6c67 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.5
+3.4.10
diff --git a/Dockerfile b/Dockerfile
index b65a227..1002a6c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=3.4.5
+ARG RUBY_VERSION=3.4.10
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
 
 # Rails app lives here
diff --git a/Dockerfile-export b/Dockerfile-export
index 7bdd939..d130d17 100644
--- a/Dockerfile-export
+++ b/Dockerfile-export
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:1
 
 # Make sure it matches the Ruby version in .ruby-version and Gemfile
-ARG RUBY_VERSION=3.4.7
+ARG RUBY_VERSION=3.4.10
 FROM ruby:$RUBY_VERSION-slim as base
 
 # Install the tools we need