diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 178eb4a..7281a7d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,12 +14,12 @@ jobs:
     name: Ruby ${{ matrix.ruby }}
     strategy:
       matrix:
-        ruby: [2.6, 2.7, 3.0, 3.1]
+        ruby: ["3.3", "3.4", "4.0"]
     steps:
     - name: Check out code
       uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: Set up Ruby ${{ matrix.ruby }}
-      uses: ruby/setup-ruby@e34163cd15f4bb403dcd72d98e295997e6a55798 # v1.238.0
+      uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
       with:
         ruby-version: ${{ matrix.ruby }}
         bundler-cache: true
diff --git a/.rubocop.yml b/.rubocop.yml
index 1b031ad..b9a2eda 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -4,7 +4,6 @@ inherit_gem:
   rubocop-shopify: rubocop.yml
 
 AllCops:
-  TargetRubyVersion: 2.6
   SuggestExtensions: false
 
 # Allow .ruby-version and spec.required_ruby_version to differ
diff --git a/.ruby-version b/.ruby-version
index 37c2961..7919852 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-2.7.2
+4.0.9
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 78afece..71fa55e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # Changelog
 
 ## [v1.0.1] - Unreleased
+- Breaking: Oktakit now requires Ruby 3.3 or later.
 - Security: resource helpers now validate and percent-encode every ID as a single URL path segment.
   Previously an ID containing `/`, `?`, `#`, `%`, or `;` could change which Okta endpoint or resource was
   called (for example, `get_user("00uX/factors")` requested `/users/00uX/factors`), and an ID of `..`
diff --git a/Gemfile.lock b/Gemfile.lock
index 6109ca6..c440f65 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,58 +8,82 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.4)
-      public_suffix (>= 2.0.2, < 6.0)
-    ast (2.4.2)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    ast (2.4.3)
     base64 (0.3.0)
-    byebug (11.1.3)
-    diff-lcs (1.4.4)
-    faraday (2.7.10)
-      faraday-net_http (>= 2.0, < 3.1)
-      ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.2)
-    parallel (1.21.0)
-    parser (3.0.3.2)
+    byebug (13.0.0)
+      reline (>= 0.6.0)
+    diff-lcs (1.6.2)
+    faraday (2.15.1)
+      faraday-net_http (>= 2.0, < 3.6)
+      json
+      logger
+    faraday-net_http (3.5.0)
+      net-http (~> 0.5)
+    io-console (0.9.4)
+    json (3.1.0)
+    language_server-protocol (3.17.0.6)
+    lint_roller (1.1.0)
+    logger (1.7.0)
+    net-http (0.10.0)
+      net-protocol (>= 0.3.0)
+      uri (>= 0.11.1)
+    net-protocol (0.4.0)
+      timeout
+    parallel (2.3.0)
+    parser (3.3.13.0)
       ast (~> 2.4.1)
-    public_suffix (5.0.3)
-    rainbow (3.0.0)
-    rake (13.0.6)
-    regexp_parser (2.2.0)
-    rexml (3.4.1)
-    rspec (3.10.0)
-      rspec-core (~> 3.10.0)
-      rspec-expectations (~> 3.10.0)
-      rspec-mocks (~> 3.10.0)
-    rspec-core (3.10.1)
-      rspec-support (~> 3.10.0)
-    rspec-expectations (3.10.1)
+      racc
+    prism (1.9.0)
+    public_suffix (7.0.5)
+    racc (1.8.1)
+    rainbow (3.1.1)
+    rake (13.4.2)
+    regexp_parser (2.13.1)
+    reline (0.7.0)
+      io-console (~> 0.5)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-mocks (3.10.2)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-support (3.10.3)
-    rubocop (1.23.0)
-      parallel (~> 1.10)
-      parser (>= 3.0.0.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
+    rubocop (1.92.1)
+      json (>= 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (>= 1.10)
+      parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml
-      rubocop-ast (>= 1.12.0, < 2.0)
+      regexp_parser (>= 2.11.3, < 3.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.15.0)
-      parser (>= 3.0.1.1)
-    rubocop-shopify (2.3.0)
-      rubocop (~> 1.22)
-    ruby-progressbar (1.11.0)
-    ruby2_keywords (0.0.5)
-    sawyer (0.9.2)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.50.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    rubocop-shopify (3.1.0)
+      lint_roller
+      rubocop (~> 1.89)
+    ruby-progressbar (1.13.0)
+    sawyer (0.9.3)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
-    unicode-display_width (2.1.0)
-    vcr (6.0.0)
-    yard (0.9.36)
+    timeout (0.6.1)
+    unicode-display_width (3.3.0)
+      unicode-emoji (~> 4.3)
+    unicode-emoji (4.3.0)
+    uri (1.1.2)
+    vcr (6.4.0)
+    yard (0.9.45)
 
 PLATFORMS
   -darwin-21
@@ -81,4 +105,4 @@ DEPENDENCIES
   yard
 
 BUNDLED WITH
-   2.3.24
+  4.0.20
diff --git a/dev.yml b/dev.yml
index 7b55eb8..df5d6ae 100644
--- a/dev.yml
+++ b/dev.yml
@@ -3,7 +3,7 @@
 name: oktakit
 
 up:
-  - ruby: 2.7.2
+  - ruby
   - bundler
 
 commands:
diff --git a/oktakit.gemspec b/oktakit.gemspec
index 65cb5b8..813ae87 100644
--- a/oktakit.gemspec
+++ b/oktakit.gemspec
@@ -17,7 +17,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.required_ruby_version = '>= 2.6'
+  spec.required_ruby_version = '>= 3.3'
 
   spec.add_dependency('sawyer', '>= 0.8.1', '< 0.10')
   spec.add_dependency('faraday', '>= 2.0.1', '< 3')