diff --git a/.dockerignore b/.dockerignore
index a93bc7869..da7d97cc4 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -71,6 +71,22 @@
 /sonar-project.properties
 /postcss.config.js
 
+# Ignore additional dev/CI/internal files not needed at runtime
+/.claude
+/.foreman
+/.git-hooks
+/.gitguardian.yml
+/.github_changelog_generator
+/.rspec
+/.safety-net.json
+/.slugignore
+/.sonarcloud.properties
+/.tool-versions
+/app.json
+/cliff.toml
+/issues.jsonl
+/Procfile.dev
+
 # Ignore non-Linux binaries
 /bin/vulcan
 
@@ -81,20 +97,11 @@
 /nginx.conf*
 /setup-docker-secrets.sh
 
-# Ignore markdown files not needed at runtime
-/CHANGELOG.md
-/CODE_OF_CONDUCT.md
-/CONTRIBUTING.md
-/LICENSE.md
-/NOTICE.md
-/README.md
-/RELEASE_NOTES.md
-/SECURITY.md
-/ROADMAP.md
-/BENCHMARK-VIEWER-DESIGN.md
+# Ignore root-level markdown (docs/ is kept — read at runtime by DisaGuideController)
+/*.md
+
+# Other root files not needed at runtime
 /AGENT-STATUS
-/ENVIRONMENT_VARIABLES.md
-/CLAUDE.md
 /_config.yml
 /CNAME
 /create_admin.rb
diff --git a/.github/actions/setup-ruby-source/action.yml b/.github/actions/setup-ruby-source/action.yml
new file mode 100644
index 000000000..8ced19ca0
--- /dev/null
+++ b/.github/actions/setup-ruby-source/action.yml
@@ -0,0 +1,82 @@
+name: 'Setup Ruby (source build)'
+description: >-
+  TEMPORARY drop-in replacement for ruby/setup-ruby. Compiles the pinned Ruby
+  from source (mirroring the Dockerfile's build) because ruby-builder does not
+  yet publish a prebuilt binary for it. The compiled Ruby and the installed gem
+  bundle are both cached, so the ~6-minute compile is paid only once per Ruby
+  version. Revert lint/backend back to ruby/setup-ruby (see git history) once
+  https://github.com/ruby/ruby-builder ships a binary for the pinned version.
+
+runs:
+  using: 'composite'
+  steps:
+    # Single source of truth: version from .ruby-version (matches Gemfile +
+    # Dockerfile ARG), checksum from the Dockerfile ARG. A drift between the two
+    # trips the sha256 check below, loudly.
+    - name: Resolve Ruby version and checksum
+      id: ruby
+      shell: bash
+      run: |
+        ver="$(cat .ruby-version)"
+        sha="$(grep -m1 '^ARG RUBY_SHA256=' Dockerfile | cut -d= -f2)"
+        echo "version=$ver" >> "$GITHUB_OUTPUT"
+        echo "sha256=$sha" >> "$GITHUB_OUTPUT"
+        echo "install_dir=$HOME/.rubies/$ver" >> "$GITHUB_OUTPUT"
+
+    - name: Restore compiled Ruby
+      id: ruby-cache
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ steps.ruby.outputs.install_dir }}
+        key: ruby-src-${{ runner.os }}-24.04-${{ steps.ruby.outputs.version }}-${{ steps.ruby.outputs.sha256 }}
+
+    # Needed to compile Ruby (rust is for --enable-yjit) and to build native gem
+    # extensions during bundle install (pg needs libpq-dev, etc.).
+    - name: Install build dependencies
+      shell: bash
+      run: |
+        sudo apt-get update -qq
+        sudo apt-get install -yqq --no-install-recommends \
+          autoconf bison build-essential libffi-dev libgmp-dev libpq-dev \
+          libreadline-dev libssl-dev libyaml-dev rustc zlib1g-dev
+
+    - name: Compile Ruby from source
+      if: steps.ruby-cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        RUBY_VERSION: ${{ steps.ruby.outputs.version }}
+        RUBY_SHA256: ${{ steps.ruby.outputs.sha256 }}
+        INSTALL_DIR: ${{ steps.ruby.outputs.install_dir }}
+      run: |
+        set -euo pipefail
+        curl -fsSL --proto '=https' --proto-redir '=https' "https://cache.ruby-lang.org/pub/ruby/${RUBY_VERSION%.*}/ruby-${RUBY_VERSION}.tar.gz" -o /tmp/ruby.tar.gz
+        echo "${RUBY_SHA256}  /tmp/ruby.tar.gz" | sha256sum -c -
+        tar -xzf /tmp/ruby.tar.gz -C /tmp
+        cd "/tmp/ruby-${RUBY_VERSION}"
+        ./configure --prefix="${INSTALL_DIR}" --disable-install-doc --enable-yjit
+        make -j"$(nproc)"
+        make install
+
+    - name: Add Ruby to PATH
+      shell: bash
+      run: echo "${{ steps.ruby.outputs.install_dir }}/bin" >> "$GITHUB_PATH"
+
+    - name: Install bundler
+      shell: bash
+      run: |
+        bundler_version="$(awk '/BUNDLED WITH/{getline; gsub(/[[:space:]]/,""); print; exit}' Gemfile.lock)"
+        gem install bundler -v "$bundler_version" --no-document
+
+    - name: Restore gem bundle
+      id: bundle-cache
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: vendor/bundle
+        key: bundle-${{ runner.os }}-ruby-${{ steps.ruby.outputs.version }}-${{ hashFiles('Gemfile.lock') }}
+
+    - name: Install gems
+      shell: bash
+      run: |
+        bundle config set --local path vendor/bundle
+        bundle config set --local deployment true
+        bundle install --jobs 4
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 09d4caecc..a10aefd21 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,17 +28,18 @@ jobs:
   # ─── LINT + SECURITY ─────────────────────────────────────
   lint:
     runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    # Higher than the usual 10 to absorb a cold Ruby-from-source compile on the
+    # first run after a version bump; cached runs are back to normal.
+    timeout-minutes: 20
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
-      - uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1
-        with:
-          ruby-version: '.ruby-version'
-          bundler-cache: true
+      # TEMPORARY: source-build Ruby because ruby-builder has no prebuilt binary
+      # for the pinned version yet. Revert to ruby/setup-ruby once it does.
+      - uses: ./.github/actions/setup-ruby-source
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
@@ -81,7 +82,9 @@ jobs:
   # ─── BACKEND TESTS + COVERAGE (6 shards) ─────────────────
   backend:
     runs-on: ubuntu-24.04
-    timeout-minutes: 25
+    # Higher than the usual 25 to absorb a cold Ruby-from-source compile on the
+    # first run after a version bump; cached runs are back to normal.
+    timeout-minutes: 35
     permissions:
       contents: read
     strategy:
@@ -141,17 +144,15 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
-      - uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1
-        with:
-          ruby-version: '.ruby-version'
-          bundler-cache: true
+      # TEMPORARY: source-build Ruby because ruby-builder has no prebuilt binary
+      # for the pinned version yet. Revert to ruby/setup-ruby once it does.
+      # (This action also installs libpq-dev and the gem bundle.)
+      - uses: ./.github/actions/setup-ruby-source
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'yarn'
       - run: yarn install --frozen-lockfile
-      - name: Install system dependencies
-        run: sudo apt-get -yqq install libpq-dev
 
       - name: Cache JS build
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
diff --git a/.ruby-version b/.ruby-version
index 7bcbb3808..84d6c6765 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.9
+3.4.10
diff --git a/.tool-versions b/.tool-versions
index de988d76b..ff8ba064d 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,2 @@
-ruby 3.4.9
+ruby 3.4.10
 nodejs 22.13.1
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index a3f4f0704..30ea6049d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,16 +16,18 @@
 #   docker buildx build --platform linux/amd64,linux/arm64 --target production -t vulcan:prod .
 # =============================================================================
 
-ARG RUBY_VERSION=3.4.9
+ARG RUBY_VERSION=3.4.10
 # Upstream SHA256 from https://www.ruby-lang.org/en/news/<release>/
-ARG RUBY_SHA256=7bb4d4f5e807cc27251d14d9d6086d182c5b25875191e44ab15b709cd7a7dd9c
+# 3.4.10 (2026-06-30) ships default gem erb 4.0.4.1 (CVE-2026-41316) and
+# net-imap 0.5.15 (CVE-2026-4224x) — clears the ruby-layer default-gem findings.
+ARG RUBY_SHA256=ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec
 ARG BUNDLER_VERSION=2.7.2
-ARG NODE_VERSION=24.14.0
+ARG NODE_VERSION=24.18.0
 
 # =============================================================================
 # BASE STAGE - Common foundation for all stages
 # =============================================================================
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7 AS base
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7@sha256:907b68736aa798b2d38255b7aa070b2a70acb90803864a40f05d0ec47556ddd0 AS base
 
 USER 0
 
@@ -115,9 +117,9 @@ RUN microdnf update -y && \
 # findutils, tar, xz are kept here (build-time only) and intentionally
 # excluded from the base stage — they're not needed at runtime.
 
-RUN curl -fsSL https://cache.ruby-lang.org/pub/ruby/${RUBY_VERSION%.*}/ruby-${RUBY_VERSION}.tar.gz -o /tmp/ruby.tar.gz && \
+RUN curl -fsSL --proto '=https' --proto-redir '=https' https://cache.ruby-lang.org/pub/ruby/${RUBY_VERSION%.*}/ruby-${RUBY_VERSION}.tar.gz -o /tmp/ruby.tar.gz && \
     echo "${RUBY_SHA256}  /tmp/ruby.tar.gz" | sha256sum -c - && \
-    tar -xzf /tmp/ruby.tar.gz -C /tmp && \
+    tar --no-same-owner -xzf /tmp/ruby.tar.gz -C /tmp && \
     cd /tmp/ruby-${RUBY_VERSION} && \
     ./configure --prefix=/usr/local \
       --disable-install-doc \
@@ -136,10 +138,10 @@ RUN curl -fsSL https://cache.ruby-lang.org/pub/ruby/${RUBY_VERSION%.*}/ruby-${RU
 # jemalloc — UBI doesn't ship it; compile from source for ~20-30% memory savings.
 ARG JEMALLOC_VERSION=5.3.0
 ARG JEMALLOC_SHA256=2db82d1e7119df3e71b7640219b6dfe84789bc0537983c3b7ac4f7189aecfeaa
-RUN curl -fsSL https://github.com/jemalloc/jemalloc/releases/download/${JEMALLOC_VERSION}/jemalloc-${JEMALLOC_VERSION}.tar.bz2 \
+RUN curl -fsSL --proto '=https' --proto-redir '=https' https://github.com/jemalloc/jemalloc/releases/download/${JEMALLOC_VERSION}/jemalloc-${JEMALLOC_VERSION}.tar.bz2 \
       -o /tmp/jemalloc.tar.bz2 && \
     echo "${JEMALLOC_SHA256}  /tmp/jemalloc.tar.bz2" | sha256sum -c - && \
-    tar -xjf /tmp/jemalloc.tar.bz2 -C /tmp && \
+    tar --no-same-owner -xjf /tmp/jemalloc.tar.bz2 -C /tmp && \
     cd /tmp/jemalloc-${JEMALLOC_VERSION} && \
     ./configure --prefix=/usr/local && \
     make -j"$(nproc)" && \
@@ -155,11 +157,11 @@ ARG TARGETARCH
 ENV PATH="/opt/node/bin:${PATH}"
 RUN ARCH=$([ "$TARGETARCH" = "amd64" ] && echo "x64" || echo "arm64") && \
     NODE_TARBALL="node-v${NODE_VERSION}-linux-${ARCH}.tar.xz" && \
-    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_TARBALL}" -o /tmp/node.tar.xz && \
-    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" -o /tmp/node.sha256 && \
+    curl -fsSL --proto '=https' --proto-redir '=https' "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_TARBALL}" -o /tmp/node.tar.xz && \
+    curl -fsSL --proto '=https' --proto-redir '=https' "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" -o /tmp/node.sha256 && \
     awk -v t="${NODE_TARBALL}" '$2 == t { print $1 "  /tmp/node.tar.xz" }' /tmp/node.sha256 | sha256sum -c - && \
     mkdir -p /opt/node && \
-    tar -xJf /tmp/node.tar.xz -C /opt/node --strip-components=1 && \
+    tar --no-same-owner -xJf /tmp/node.tar.xz -C /opt/node --strip-components=1 && \
     rm -f /tmp/node.tar.xz /tmp/node.sha256 && \
     corepack enable
 
@@ -176,18 +178,16 @@ ENV RAILS_ENV="production" \
     BUNDLE_DEPLOYMENT="1" \
     BUNDLE_WITHOUT="development:test"
 
-COPY --chown=1000:0 --chmod=440 Gemfile Gemfile.lock ./
+COPY --chown=1000:0 . .
+
 RUN --mount=type=cache,target=/usr/local/bundle/cache,uid=1000 \
     bundle install && \
     rm -rf "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \
     bundle exec bootsnap precompile --gemfile
 
-COPY --chown=1000:0 --chmod=440 package.json yarn.lock esbuild.config.js ./
 RUN --mount=type=cache,target=/tmp/.yarn-cache,uid=1000 \
     yarn install --frozen-lockfile --production=false --network-timeout 100000 --cache-folder /tmp/.yarn-cache
 
-COPY --chown=1000:0 . .
-
 RUN bundle exec bootsnap precompile app/ lib/ && \
     SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile && \
     rm -rf \
@@ -235,10 +235,8 @@ ENV RAILS_ENV="development" \
     BUNDLE_DEPLOYMENT="0" \
     LD_PRELOAD="/usr/local/lib/libjemalloc.so"
 
-COPY --chown=1000:0 --chmod=440 Gemfile Gemfile.lock ./
+COPY --chown=1000:0 Gemfile Gemfile.lock package.json yarn.lock esbuild.config.js ./
 RUN bundle install
-
-COPY --chown=1000:0 --chmod=440 package.json yarn.lock esbuild.config.js ./
 RUN yarn install --frozen-lockfile
 
 COPY --chown=1000:0 . .
diff --git a/Gemfile b/Gemfile
index c8b8ace44..a015e6bc1 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,7 +2,7 @@
 
 source 'https://rubygems.org'
 
-ruby '3.4.9'
+ruby '3.4.10'
 
 # Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
 gem 'rails', '~> 8.0.0'
@@ -156,3 +156,5 @@ gem 'blueprinter', '~> 1.2'
 gem 'blueprinter-activerecord', '~> 1.3'
 
 gem 'oj', '~> 3.16'
+
+gem 'faraday', '~> 1.10', '>= 1.10.6'
diff --git a/Gemfile.lock b/Gemfile.lock
index 24513e850..a63e10ed3 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -10,29 +10,29 @@ GEM
   remote: https://rubygems.org/
   specs:
     abbrev (0.1.2)
-    actioncable (8.0.5)
-      actionpack (= 8.0.5)
-      activesupport (= 8.0.5)
+    actioncable (8.0.5.1)
+      actionpack (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (8.0.5)
-      actionpack (= 8.0.5)
-      activejob (= 8.0.5)
-      activerecord (= 8.0.5)
-      activestorage (= 8.0.5)
-      activesupport (= 8.0.5)
+    actionmailbox (8.0.5.1)
+      actionpack (= 8.0.5.1)
+      activejob (= 8.0.5.1)
+      activerecord (= 8.0.5.1)
+      activestorage (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       mail (>= 2.8.0)
-    actionmailer (8.0.5)
-      actionpack (= 8.0.5)
-      actionview (= 8.0.5)
-      activejob (= 8.0.5)
-      activesupport (= 8.0.5)
+    actionmailer (8.0.5.1)
+      actionpack (= 8.0.5.1)
+      actionview (= 8.0.5.1)
+      activejob (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (8.0.5)
-      actionview (= 8.0.5)
-      activesupport (= 8.0.5)
+    actionpack (8.0.5.1)
+      actionview (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       nokogiri (>= 1.8.5)
       rack (>= 2.2.4)
       rack-session (>= 1.0.1)
@@ -40,27 +40,27 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (8.0.5)
-      actionpack (= 8.0.5)
-      activerecord (= 8.0.5)
-      activestorage (= 8.0.5)
-      activesupport (= 8.0.5)
+    actiontext (8.0.5.1)
+      actionpack (= 8.0.5.1)
+      activerecord (= 8.0.5.1)
+      activestorage (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (8.0.5)
-      activesupport (= 8.0.5)
+    actionview (8.0.5.1)
+      activesupport (= 8.0.5.1)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (8.0.5)
-      activesupport (= 8.0.5)
+    activejob (8.0.5.1)
+      activesupport (= 8.0.5.1)
       globalid (>= 0.3.6)
-    activemodel (8.0.5)
-      activesupport (= 8.0.5)
-    activerecord (8.0.5)
-      activemodel (= 8.0.5)
-      activesupport (= 8.0.5)
+    activemodel (8.0.5.1)
+      activesupport (= 8.0.5.1)
+    activerecord (8.0.5.1)
+      activemodel (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       timeout (>= 0.4.0)
     activerecord-import (2.2.0)
       activerecord (>= 4.2)
@@ -70,13 +70,13 @@ GEM
       cgi (>= 0.3.6)
       rack (>= 2.0.8, < 4)
       railties (>= 7.0)
-    activestorage (8.0.5)
-      actionpack (= 8.0.5)
-      activejob (= 8.0.5)
-      activerecord (= 8.0.5)
-      activesupport (= 8.0.5)
+    activestorage (8.0.5.1)
+      actionpack (= 8.0.5.1)
+      activejob (= 8.0.5.1)
+      activerecord (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       marcel (~> 1.0)
-    activesupport (8.0.5)
+    activesupport (8.0.5.1)
       base64
       benchmark (>= 0.3)
       bigdecimal
@@ -113,7 +113,7 @@ GEM
     blueprinter-activerecord (1.3.0)
       activerecord (>= 6.0)
       blueprinter (~> 1.0)
-    bootsnap (1.18.6)
+    bootsnap (1.24.6)
       msgpack (~> 1.2)
     brakeman (7.1.0)
       racc
@@ -158,14 +158,14 @@ GEM
     commonmarker (2.7.0-arm64-darwin)
     commonmarker (2.7.0-x86_64-linux)
     commonmarker (2.7.0-x86_64-linux-musl)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
     cookstyle (8.4.0)
       rubocop (= 1.79.2)
     crack (1.0.0)
       bigdecimal
       rexml
-    crass (1.0.6)
+    crass (1.0.7)
     csv (3.3.5)
     database_cleaner-active_record (2.2.2)
       activerecord (>= 5.a)
@@ -195,7 +195,7 @@ GEM
     factory_bot_rails (6.5.1)
       factory_bot (~> 6.5)
       railties (>= 6.1.0)
-    faraday (1.10.5)
+    faraday (1.10.6)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
@@ -213,13 +213,13 @@ GEM
     faraday-follow_redirects (0.3.0)
       faraday (>= 1, < 3)
     faraday-httpclient (1.0.1)
-    faraday-multipart (1.1.1)
+    faraday-multipart (1.2.0)
       multipart-post (~> 2.0)
     faraday-net_http (1.0.2)
     faraday-net_http_persistent (1.2.0)
     faraday-patron (1.0.0)
     faraday-rack (1.0.0)
-    faraday-retry (1.0.3)
+    faraday-retry (1.0.4)
     faraday_middleware (1.2.1)
       faraday (~> 1.0)
     ffaker (2.24.0)
@@ -292,7 +292,7 @@ GEM
       activesupport (>= 7.0.0)
     jsbundling-rails (1.3.1)
       railties (>= 6.0.0)
-    json (2.13.2)
+    json (2.21.1)
     json-jwt (1.15.3.1)
       activesupport (>= 4.2)
       aes_key_wrap
@@ -317,7 +317,7 @@ GEM
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.9.0)
@@ -347,7 +347,7 @@ GEM
     mixlib-log (3.0.9)
     mixlib-shellout (3.3.9)
       chef-utils
-    msgpack (1.8.0)
+    msgpack (1.8.3)
     multi_xml (0.7.2)
       bigdecimal (~> 3.1)
     multipart-post (2.4.1)
@@ -392,7 +392,7 @@ GEM
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0, >= 2.0.6)
       version_gem (~> 1.1, >= 1.1.12)
-    oj (3.16.16)
+    oj (3.17.4)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
     omniauth (2.1.3)
@@ -488,30 +488,30 @@ GEM
     rackup (1.0.1)
       rack (< 3)
       webrick
-    rails (8.0.5)
-      actioncable (= 8.0.5)
-      actionmailbox (= 8.0.5)
-      actionmailer (= 8.0.5)
-      actionpack (= 8.0.5)
-      actiontext (= 8.0.5)
-      actionview (= 8.0.5)
-      activejob (= 8.0.5)
-      activemodel (= 8.0.5)
-      activerecord (= 8.0.5)
-      activestorage (= 8.0.5)
-      activesupport (= 8.0.5)
+    rails (8.0.5.1)
+      actioncable (= 8.0.5.1)
+      actionmailbox (= 8.0.5.1)
+      actionmailer (= 8.0.5.1)
+      actionpack (= 8.0.5.1)
+      actiontext (= 8.0.5.1)
+      actionview (= 8.0.5.1)
+      activejob (= 8.0.5.1)
+      activemodel (= 8.0.5.1)
+      activerecord (= 8.0.5.1)
+      activestorage (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       bundler (>= 1.15.0)
-      railties (= 8.0.5)
+      railties (= 8.0.5.1)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (8.0.5)
-      actionpack (= 8.0.5)
-      activesupport (= 8.0.5)
+    railties (8.0.5.1)
+      actionpack (= 8.0.5.1)
+      activesupport (= 8.0.5.1)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -714,7 +714,7 @@ GEM
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.9.2)
     websocket (1.2.11)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
@@ -755,6 +755,7 @@ DEPENDENCIES
   devise-security!
   dotenv-rails
   factory_bot_rails (~> 6.5.0)
+  faraday (~> 1.10, >= 1.10.6)
   ffaker (~> 2.10)
   foreman
   haml-rails (~> 2.0)
@@ -808,7 +809,7 @@ DEPENDENCIES
   with_advisory_lock (~> 5.1)
 
 RUBY VERSION
-   ruby 3.4.9p82
+   ruby 3.4.10p104
 
 BUNDLED WITH
    2.7.2
diff --git a/docker-bake.hcl b/docker-bake.hcl
index a484d0369..a118c3574 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -15,7 +15,7 @@
 // We use VULCAN_RUBY_VERSION to avoid this conflict. If a prefixed value leaks into
 // the build, you may see an invalid Ruby source download URL or a failure to fetch
 // the Ruby tarball. Either:
-//   - Set VULCAN_RUBY_VERSION=3.4.9, or
+//   - Set VULCAN_RUBY_VERSION=3.4.10, or
 //   - Run: unset RUBY_VERSION && docker buildx bake
 // The Dockerfile uses a fixed UBI minimal base image and builds Ruby from source based on the var.
 
@@ -40,11 +40,11 @@ variable "VULCAN_BUNDLER_VERSION" {
 }
 
 variable "VULCAN_RUBY_VERSION" {
-  default = "3.4.9"
+  default = "3.4.10"
 }
 
 variable "VULCAN_NODE_VERSION" {
-  default = "24.14.0"
+  default = "24.18.0"
 }
 
 // ============================================================================
diff --git a/yarn.lock b/yarn.lock
index 220adb5c8..40086e804 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1204,6 +1204,15 @@ axios@1.12.2:
     form-data "^4.0.4"
     proxy-from-env "^1.1.0"
 
+axios@<=1.14.0:
+  version "1.14.0"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.14.0.tgz#7c29f4cf2ea91ef05018d5aa5399bf23ed3120eb"
+  integrity sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==
+  dependencies:
+    follow-redirects "^1.15.11"
+    form-data "^4.0.5"
+    proxy-from-env "^2.1.0"
+
 babel-walk@3.0.0-canary-5:
   version "3.0.0-canary-5"
   resolved "https://registry.yarnpkg.com/babel-walk/-/babel-walk-3.0.0-canary-5.tgz#f66ecd7298357aee44955f235a6ef54219104b11"
@@ -2095,6 +2104,11 @@ flatted@^3.2.9:
   resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.3.3.tgz#67c8fad95454a7c7abebf74bb78ee74a44023358"
   integrity sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==
 
+follow-redirects@^1.15.11:
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.16.0.tgz#28474a159d3b9d11ef62050a14ed60e4df6d61bc"
+  integrity sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==
+
 follow-redirects@^1.15.6:
   version "1.15.11"
   resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.11.tgz#777d73d72a92f8ec4d2e410eb47352a56b8e8340"
@@ -2124,6 +2138,17 @@ form-data@^4.0.4:
     hasown "^2.0.2"
     mime-types "^2.1.12"
 
+form-data@^4.0.5:
+  version "4.0.6"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827"
+  integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==
+  dependencies:
+    asynckit "^0.4.0"
+    combined-stream "^1.0.8"
+    es-set-tostringtag "^2.1.0"
+    hasown "^2.0.4"
+    mime-types "^2.1.35"
+
 fs.realpath@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/fs.realpath/-/fs.realpath-1.0.0.tgz#1504ad2523158caa40db4a2787cb01411994ea4f"
@@ -2264,6 +2289,13 @@ hasown@^2.0.2:
   dependencies:
     function-bind "^1.1.2"
 
+hasown@^2.0.4:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.4.tgz#8c62d8cb90beb2aad5d0a5b67581ad9854c3f003"
+  integrity sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==
+  dependencies:
+    function-bind "^1.1.2"
+
 hast-util-to-html@^9.0.5:
   version "9.0.5"
   resolved "https://registry.yarnpkg.com/hast-util-to-html/-/hast-util-to-html-9.0.5.tgz#ccc673a55bb8e85775b08ac28380f72d47167005"
@@ -2831,7 +2863,7 @@ mime-db@1.52.0:
   resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70"
   integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==
 
-mime-types@^2.1.12:
+mime-types@^2.1.12, mime-types@^2.1.35:
   version "2.1.35"
   resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
   integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
@@ -3245,6 +3277,11 @@ proxy-from-env@^1.1.0:
   resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-1.1.0.tgz#e102f16ca355424865755d2c9e8ea4f24d58c3e2"
   integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==
 
+proxy-from-env@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-2.1.0.tgz#a7487568adad577cfaaa7e88c49cab3ab3081aba"
+  integrity sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==
+
 prr@~1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/prr/-/prr-1.0.1.tgz#d3fc114ba06995a45ec6893f484ceb1d78f5f476"