diff --git a/.ruby-version b/.ruby-version
index 7bcbb380..d13e837c 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.9
+4.0.6
diff --git a/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb b/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
index 0e1e769b..239dc29b 100644
--- a/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
+++ b/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
@@ -9,7 +9,7 @@
 BOSH_ENV_DEPS = "build-essential zlib1g-dev openssl libxslt1-dev libxml2-dev \
     libssl-dev libreadline8 libreadline-dev libyaml-dev libsqlite3-dev sqlite3"
 CF_ENV_DEPS = "unzip curl openssl ca-certificates git libc6 bash jq gettext make"
-RUBY_VERSION = "3.4"
+RUBY_VERSION = "4.0"
 
 describe "bosh-cli-v2-cf-cli image" do
   before(:all) {
diff --git a/bosh-cli-v2/bosh-cli-v2_spec.rb b/bosh-cli-v2/bosh-cli-v2_spec.rb
index 0717429c..46a3e2f7 100644
--- a/bosh-cli-v2/bosh-cli-v2_spec.rb
+++ b/bosh-cli-v2/bosh-cli-v2_spec.rb
@@ -4,7 +4,7 @@
 
 BOSH_CLI_VERSION="7.10.5" # renovate: datasource=github-releases depName=cloudfoundry/bosh-cli
 CREDHUB_CLI_VERSION='2.9.57' # renovate: datasource=github-releases depName=cloudfoundry/credhub-cli
-RUBY_VERSION = "3.4"
+RUBY_VERSION = "4.0"
 
 BOSH_ENV_DEPS = "build-essential zlib1g-dev openssl libxslt1-dev libxml2-dev \
     libssl-dev libreadline8 libreadline-dev libyaml-dev libsqlite3-dev sqlite3"
diff --git a/cf-cli/Dockerfile b/cf-cli/Dockerfile
index a01a8cde..3d52423d 100644
--- a/cf-cli/Dockerfile
+++ b/cf-cli/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.4-alpine3.22
+FROM ruby:4.0-alpine3.22@sha256:fae3127404cb61d6897d7eed08e65ec7ccc96ba0542dc7c44712efa9b2ef78f0
 
 ENV PACKAGES="unzip curl openssl ca-certificates git libc6-compat bash jq gettext make"
 # renovate: datasource=github-releases depName=cloudfoundry/cli
diff --git a/cf-cli/cf-cli_spec.rb b/cf-cli/cf-cli_spec.rb
index cd6db114..86f5e97c 100644
--- a/cf-cli/cf-cli_spec.rb
+++ b/cf-cli/cf-cli_spec.rb
@@ -5,7 +5,7 @@
 CF_CLI_VERSION="8.18.3" # renovate: datasource=github-releases depName=cloudfoundry/cli
 SPRUCE_BIN = "/usr/local/bin/spruce"
 SPRUCE_VERSION = "1.35.7" # renovate: datasource=github-releases depName=geofffranks/spruce
-RUBY_VERSION = "3.4"
+RUBY_VERSION = "4.0"
 
 describe "cf-cli image" do
   before(:all) {
diff --git a/k8s-tools/Dockerfile b/k8s-tools/Dockerfile
index 33f97c4e..a24afae2 100644
--- a/k8s-tools/Dockerfile
+++ b/k8s-tools/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.4-slim
+FROM ruby:4.0-slim@sha256:58479f164d5947f852da27a4436c89bb986a811f959c40552bc7f6ccaabcc9c9
 
 # we use libc6 instead of libc6-compat as we do not use alpine base image
 ENV PACKAGES="unzip curl openssl ca-certificates git libc6 bash jq gettext"
diff --git a/k8s-tools/k8s-tools_spec.rb b/k8s-tools/k8s-tools_spec.rb
index 8c40e0ed..281ae8c8 100644
--- a/k8s-tools/k8s-tools_spec.rb
+++ b/k8s-tools/k8s-tools_spec.rb
@@ -10,7 +10,7 @@
 KUBECTL_VERSION="1.34.9" # renovate: datasource=github-tags depName=kubernetes/kubectl
 HELM_VERSION="3.17.1" # renovate: datasource=github-releases depName=helm/helm
 #KUTTL_VERSION="0.26.0" # renovate: datasource=github-releases depName=kudobuilder/kuttl
-RUBY_VERSION = "3.4"
+RUBY_VERSION = "4.0"
 
 DEPS = "unzip curl openssl ca-certificates git libc6 bash jq gettext"