diff --git a/Gemfile b/Gemfile
index ecd5dac8b9d28..83c87720a9450 100644
--- a/Gemfile
+++ b/Gemfile
@@ -40,7 +40,7 @@ gem "bcrypt", "~> 3.1.11", require: false
 gem "terser", ">= 1.1.4", require: false
 
 # Explicitly avoid 1.x that doesn't support Ruby 2.4+
-gem "json", ">= 2.0.0"
+gem "json", "<= 2.6.3"
 
 # Workaround until Ruby ships with cgi version 0.3.6 or higher.
 gem "cgi", ">= 0.3.6", require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 0cf50b3952972..c3b6178b0352f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -588,12 +588,13 @@ DEPENDENCIES
   debug (>= 1.1.0)
   delayed_job
   delayed_job_active_record
+  error_highlight (>= 0.4.0)
   google-cloud-storage (~> 1.11)
   image_processing (~> 1.2)
   importmap-rails (>= 1.2.3)
   jbuilder
   jsbundling-rails
-  json (>= 2.0.0)
+  json (<= 2.6.3)
   libxml-ruby
   listen (~> 3.3)
   mdl