diff --git a/.rubocop.yml b/.rubocop.yml
index 3f3a19a4b3..11337962cf 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -257,6 +257,34 @@ Rails/HelperInstanceVariable:
 Rails/FilePath:
   Enabled: false
 
+# TODO: enable
+Rails/FindEach:
+  Enabled: false
+
+# TODO: enable
+Rails/IndexBy:
+  Enabled: false
+
+# TODO: enable
+Rails/IndexWith:
+  Enabled: false
+
+# we don't always need environment
+Rails/RakeEnvironment:
+  Enabled: false
+
+# TODO: enable
+Rails/ApplicationController:
+  Enabled: false
+
+# TODO: enable
+Rails/ContentTag:
+  Enabled: false
+
+# TODO: enable
+Rails/UniqueValidationWithoutIndex:
+  Enabled: false
+
 Gemspec/RequiredRubyVersion:
   Enabled: false
 
@@ -266,3 +294,6 @@ Style/AccessorGrouping:
 # produces false-positives with html-safe, see app/helpers/application_helper.rb
 Style/StringConcatenation:
   Enabled: false
+
+Style/HashSyntax:
+  Enabled: false
diff --git a/.ruby-version b/.ruby-version
index 818bd47abf..be94e6f53d 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.0.6
+3.2.2
diff --git a/Dockerfile b/Dockerfile
index 1b91ca41fe..08534fcb23 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.0.6-slim
+FROM ruby:3.2-slim
 
 # Install dependencies
 RUN \
diff --git a/Gemfile b/Gemfile
index eaace88247..bedfc7b2e6 100644
--- a/Gemfile
+++ b/Gemfile
@@ -8,7 +8,7 @@ group :preload do
   gem 'rails', '~> 6.1.7.6'
   gem 'dotenv'
   gem 'connection_pool'
-  gem 'marco-polo'
+  gem 'marco-polo' # TODO: https://github.com/arches/marco-polo/pull/16
 
   # AR extensions
   gem 'goldiloader'
@@ -39,6 +39,7 @@ gem 'octokit'
 gem 'faraday', '~> 2.7'
 gem 'faraday-net_http_persistent', '~> 2.0'
 gem 'faraday-http-cache'
+gem 'faraday-retry'
 gem 'warden'
 gem 'active_hash'
 gem 'ansible'
@@ -55,6 +56,9 @@ gem 'validates_lengths_from_database'
 gem 'large_object_store'
 gem 'parallel'
 gem 'stackprof'
+gem 'net-smtp'
+gem 'net-pop'
+gem 'net-imap'
 
 # treat included plugins like gems
 Dir[File.join(Bundler.root, 'plugins/*/')].each { |f| gemspec path: f }
diff --git a/Gemfile.lock b/Gemfile.lock
index e0cd65318a..e34971af1b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -332,6 +332,7 @@ GEM
     crass (1.0.6)
     dalli (3.2.7)
       base64
+    date (3.3.4)
     ddtrace (0.45.0)
       msgpack
     debug_inspector (0.0.3)
@@ -357,6 +358,8 @@ GEM
     faraday-net_http_persistent (2.1.0)
       faraday (~> 2.5)
       net-http-persistent (~> 4.0)
+    faraday-retry (2.2.0)
+      faraday (~> 2.0)
     ffi (1.16.3)
     ffi-compiler (1.0.1)
       ffi (>= 1.0.0)
@@ -380,7 +383,7 @@ GEM
     goldiloader (3.2.0)
       activerecord (>= 4.2, < 6.3)
       activesupport (>= 4.2, < 6.3)
-    hashdiff (0.4.0)
+    hashdiff (1.1.0)
     hashie (5.0.0)
     http (5.2.0)
       addressable (~> 2.8)
@@ -438,19 +441,20 @@ GEM
       railties (>= 6)
     maxitest (3.7.0)
       minitest (>= 5.0.0, < 5.15.0)
-    method_source (0.9.2)
+    method_source (1.0.0)
     mime-types (3.5.2)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2024.0206)
     mini_mime (1.1.5)
     mini_portile2 (2.8.5)
-    minitest (5.11.3)
+    minitest (5.14.4)
     minitest-rails (6.1.1)
       minitest (~> 5.10)
       railties (~> 6.1.0)
     mixlib-shellout (3.2.7)
       chef-utils
-    mocha (1.16.1)
+    mocha (2.1.0)
+      ruby2_keywords (>= 0.0.5)
     momentjs-rails (2.29.4.1)
       railties (>= 3.1)
     msgpack (1.7.2)
@@ -460,7 +464,16 @@ GEM
     mysql2 (0.5.5)
     net-http-persistent (4.0.2)
       connection_pool (~> 2.2)
+    net-imap (0.4.10)
+      date
+      net-protocol
     net-ldap (0.19.0)
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.2.2)
+      timeout
+    net-smtp (0.4.0.1)
+      net-protocol
     netrc (0.11.0)
     newrelic_rpm (9.7.1)
     nio4r (2.7.0)
@@ -514,9 +527,9 @@ GEM
       racc
     path_expander (1.1.1)
     pg (1.5.4)
-    pry (0.12.2)
-      coderay (~> 1.1.0)
-      method_source (~> 0.9.0)
+    pry (0.14.2)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
     pry-byebug (3.3.0)
       byebug (~> 8.0)
       pry (~> 0.10)
@@ -601,9 +614,11 @@ GEM
       unicode-display_width (>= 1.4.0, < 3.0)
     rubocop-ast (1.30.0)
       parser (>= 3.2.1.0)
-    rubocop-rails (2.3.2)
+    rubocop-rails (2.23.1)
+      activesupport (>= 4.2.0)
       rack (>= 1.1)
-      rubocop (>= 0.72.0)
+      rubocop (>= 1.33.0, < 2.0)
+      rubocop-ast (>= 1.30.0, < 2.0)
     ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
     ruby_parser (3.21.0)
@@ -658,6 +673,7 @@ GEM
       unicode-display_width (~> 1.1, >= 1.1.1)
     thor (1.3.0)
     tilt (2.3.0)
+    timeout (0.4.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     uglifier (3.2.0)
@@ -716,6 +732,7 @@ DEPENDENCIES
   faraday (~> 2.7)
   faraday-http-cache
   faraday-net_http_persistent (~> 2.0)
+  faraday-retry
   flay
   forking_test_runner
   gcloud_image_tagger!
@@ -731,6 +748,9 @@ DEPENDENCIES
   momentjs-rails
   mysql2
   net-http-persistent
+  net-imap
+  net-pop
+  net-smtp
   oauth2 (~> 2.0.9)
   octokit
   omniauth (~> 2.0)
@@ -805,7 +825,7 @@ DEPENDENCIES
   webmock
 
 RUBY VERSION
-   ruby 3.0.6p216
+   ruby 3.2.2p53
 
 BUNDLED WITH
    2.4.22
diff --git a/app/models/concerns/has_role.rb b/app/models/concerns/has_role.rb
index fe4b990441..6454b06359 100644
--- a/app/models/concerns/has_role.rb
+++ b/app/models/concerns/has_role.rb
@@ -4,7 +4,7 @@ def role
     Role.find(role_id)
   end
 
-  Role.all.each do |role| # rubocop:disable Rails/FindEach
+  Role.all.each do |role| # rubocop:disable Lint/RedundantCopDisableDirective Rails/FindEach
     define_method "#{role.name}?" do
       role_id >= role.id
     end
diff --git a/config/application.rb b/config/application.rb
index 2ede208df7..f15c3a1973 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -188,7 +188,7 @@ def self.deprecated_url(var)
         RestartSignalHandler.after_restart
         RestartSignalHandler.listen
       end
-      Samson::BootCheck.check if Rails.env.development?
+      # Samson::BootCheck.check if Rails.env.development? # TODO: re-enable
     end
 
     unless ENV['PRECOMPILE']
diff --git a/db/migrate/20150223135916_create_deploy_groups.rb b/db/migrate/20150223135916_create_deploy_groups.rb
index 045cbf36ae..fd64820507 100644
--- a/db/migrate/20150223135916_create_deploy_groups.rb
+++ b/db/migrate/20150223135916_create_deploy_groups.rb
@@ -18,7 +18,7 @@ def change
     end
     add_foreign_key :deploy_groups, :environments
 
-    create_table :deploy_groups_stages, id: false do |t| # rubocop:disable Rails/CreateTableWithTimestamps
+    create_table :deploy_groups_stages, id: false do |t|
       t.belongs_to :deploy_group, index: true
       t.belongs_to :stage, index: true
     end
diff --git a/db/migrate/20170616180533_seed_audited_from_versions.rb b/db/migrate/20170616180533_seed_audited_from_versions.rb
index 4ee2709843..c58ccba47c 100644
--- a/db/migrate/20170616180533_seed_audited_from_versions.rb
+++ b/db/migrate/20170616180533_seed_audited_from_versions.rb
@@ -57,8 +57,8 @@ def create_audit(version, current_state)
       if current_state == :bad
         {}
       else
-        previous_state = YAML.load(version.object || "{}").except(*IGNORED) # rubocop:disable Security/YAMLLoad
-        current_state = YAML.load(current_state || "{}").except(*IGNORED) # # rubocop:disable Security/YAMLLoad
+        previous_state = YAML.load(version.object || "{}").except(*IGNORED)
+        current_state = YAML.load(current_state || "{}").except(*IGNORED)
 
         # audited has a strange behavior where the create/destroy changes don't have arrays but just a value
         simple = ["create", "destroy"].include?(version.event)
diff --git a/plugins/kubernetes/app/models/kubernetes/util.rb b/plugins/kubernetes/app/models/kubernetes/util.rb
index 146d8c3aa6..93f39b032d 100644
--- a/plugins/kubernetes/app/models/kubernetes/util.rb
+++ b/plugins/kubernetes/app/models/kubernetes/util.rb
@@ -23,7 +23,7 @@ def self.yaml_safe_load_stream(contents, filename)
       YAML.parse_stream(contents, filename: filename).children.map do |child|
         temp_stream = Psych::Nodes::Stream.new
         temp_stream.children << child
-        YAML.safe_load(temp_stream.to_yaml, [Symbol], aliases: true)
+        YAML.safe_load(temp_stream.to_yaml, permitted_classes: [Symbol], aliases: true)
       end
     end
   end
diff --git a/plugins/kubernetes/decorators/deploy_group_decorator.rb b/plugins/kubernetes/decorators/deploy_group_decorator.rb
index 1d8b709c6b..a90d5d7046 100644
--- a/plugins/kubernetes/decorators/deploy_group_decorator.rb
+++ b/plugins/kubernetes/decorators/deploy_group_decorator.rb
@@ -3,7 +3,6 @@
   has_one(
     :cluster_deploy_group,
     class_name: 'Kubernetes::ClusterDeployGroup',
-    foreign_key: :deploy_group_id,
     inverse_of: :deploy_group,
     dependent: :destroy
   )
diff --git a/plugins/pipelines/decorators/deploy_decorator.rb b/plugins/pipelines/decorators/deploy_decorator.rb
index 23cb70b771..0bd9b8b2af 100644
--- a/plugins/pipelines/decorators/deploy_decorator.rb
+++ b/plugins/pipelines/decorators/deploy_decorator.rb
@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
 Deploy.class_eval do
-  belongs_to :triggering_deploy,
-    class_name: 'Deploy', foreign_key: 'triggering_deploy_id', optional: true, inverse_of: false
+  belongs_to :triggering_deploy, class_name: 'Deploy', optional: true, inverse_of: false
 end
diff --git a/test/controllers/unauthorized_controller_test.rb b/test/controllers/unauthorized_controller_test.rb
index af6463dbe7..886fb8126b 100644
--- a/test/controllers/unauthorized_controller_test.rb
+++ b/test/controllers/unauthorized_controller_test.rb
@@ -12,7 +12,7 @@ def app
 
   describe '#respond' do
     def request(params: {})
-      get path, {controller: "ping", action: "show"}.merge(params), headers # rubocop:disable Rails/HttpPositionalArguments
+      get path, {controller: "ping", action: "show"}.merge(params), headers
     end
 
     describe 'as html' do
diff --git a/test/lib/samson/secrets/vault_server_test.rb b/test/lib/samson/secrets/vault_server_test.rb
index 57485c76b5..e24616a616 100644
--- a/test/lib/samson/secrets/vault_server_test.rb
+++ b/test/lib/samson/secrets/vault_server_test.rb
@@ -29,7 +29,7 @@
     it "is invalid with an invalid cert" do
       server.ca_cert = "nope"
       refute_valid server
-      server.errors.full_messages.must_equal ["Ca cert is invalid: not enough data"]
+      server.errors.full_messages.must_equal ["Ca cert is invalid: PEM_read_bio_X509: no start line"]
     end
 
     it "is invalid with duplicate name" do
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 9ad330836b..0930f021e9 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -13,6 +13,7 @@
 $LOAD_PATH.delete 'lib'
 $LOAD_PATH.delete 'test'
 
+require 'maxitest/global_must'
 require_relative '../config/environment'
 require 'rails/test_help'
 require 'minitest/rails'
@@ -22,7 +23,7 @@
 require 'maxitest/timeout'
 require 'maxitest/threads'
 require 'webmock/minitest'
-require 'mocha/setup'
+require 'mocha/minitest'
 
 # Use ActiveSupport::TestCase for everything that was not matched before
 MiniTest::Spec::DSL::TYPES[-1] = [//, ActiveSupport::TestCase]