diff --git a/.rubocop.yml b/.rubocop.yml
index 59d78f8..b1c8df9 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -1,5 +1,5 @@
 AllCops:
-  TargetRubyVersion: 3.0
+  TargetRubyVersion: 3.4
   NewCops: enable
   Exclude:
     - "bin/*"
@@ -135,7 +135,7 @@ Style/FrozenStringLiteralComment:
   Enabled: true
   SafeAutoCorrect: true
 
-Naming/PredicateName:
+Naming/PredicatePrefix:
   Enabled: false
 
 Layout/LineLength:
diff --git a/.ruby-version b/.ruby-version
index 1cf8253..84d6c67 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.4.6
+3.4.10
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c6befd2..3fec735 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -6,7 +6,7 @@ This doc explains how to go about running Postal in development to allow you to
 
 You will need a MySQL database server to get started. Postal needs to be able to make databases within that server whenever new mail servers are created so the permissions that you use should be suitable for that.
 
-You'll also need Ruby. Postal currently uses Ruby 3.2.2. Install that using whichever version manager takes your fancy - rbenv, asdf, rvm etc.
+You'll also need Ruby. Postal currently uses the Ruby version in `.ruby-version`. Install that using whichever version manager takes your fancy - rbenv, asdf, rvm etc.
 
 ## Clone
 
diff --git a/Dockerfile b/Dockerfile
index 5adcb17..f7d000c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.4.6-slim-bookworm AS base
+FROM ruby:3.4.10-slim-bookworm AS base
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN apt-get update \
diff --git a/Gemfile b/Gemfile
index 4d3c0de..27eb9d7 100644
--- a/Gemfile
+++ b/Gemfile
@@ -8,12 +8,17 @@ gem "bcrypt"
 gem "chronic"
 gem "domain_name"
 gem "dotenv"
-gem "dynamic_form"
-gem "execjs", "~> 2.7", "< 2.8"
+gem "execjs"
 gem "gelf"
 gem "haml"
 gem "hashie"
 gem "highline", require: false
+# json 3.0 removed the `quirks_mode` option, which Active Support 7.2 still
+# passes in both its JSON encoder and decoder. Nothing else constrains json, so
+# without this pin Bundler resolves to 3.x and every `to_json` call raises
+# ArgumentError. Active Support dropped those calls in Rails 8.1, so this pin
+# can go when we move to 8.1.
+gem "json", "< 3"
 gem "jwt"
 gem "kaminari"
 gem "klogger-logger"
@@ -29,7 +34,7 @@ gem "ostruct"
 gem "prometheus-client"
 gem "puma"
 gem "rackup"
-gem "rails", "= 7.1.6"
+gem "rails", "= 7.2.3.2"
 gem "resolv"
 gem "secure_headers"
 gem "sentry-rails"
@@ -43,7 +48,7 @@ group :oidc do
   gem "omniauth-rails_csrf_protection"
 end
 
-group :development, :assets do
+group :development, :test, :assets do
   gem "coffee-rails", "~> 5.0"
   gem "jquery-rails"
   gem "sass-rails"
diff --git a/Gemfile.lock b/Gemfile.lock
index 16adf02..c154b6e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -2,104 +2,98 @@ GEM
   remote: https://rubygems.org/
   specs:
     abbrev (0.1.2)
-    actioncable (7.1.6)
-      actionpack (= 7.1.6)
-      activesupport (= 7.1.6)
+    actioncable (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.1.6)
-      actionpack (= 7.1.6)
-      activejob (= 7.1.6)
-      activerecord (= 7.1.6)
-      activestorage (= 7.1.6)
-      activesupport (= 7.1.6)
-      mail (>= 2.7.1)
-      net-imap
-      net-pop
-      net-smtp
-    actionmailer (7.1.6)
-      actionpack (= 7.1.6)
-      actionview (= 7.1.6)
-      activejob (= 7.1.6)
-      activesupport (= 7.1.6)
-      mail (~> 2.5, >= 2.5.4)
-      net-imap
-      net-pop
-      net-smtp
+    actionmailbox (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
+      mail (>= 2.8.0)
+    actionmailer (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      actionview (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
+      mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.1.6)
-      actionview (= 7.1.6)
-      activesupport (= 7.1.6)
+    actionpack (7.2.3.2)
+      actionview (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       cgi
       nokogiri (>= 1.8.5)
       racc
-      rack (>= 2.2.4)
+      rack (>= 2.2.4, < 3.3)
       rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    actiontext (7.1.6)
-      actionpack (= 7.1.6)
-      activerecord (= 7.1.6)
-      activestorage (= 7.1.6)
-      activesupport (= 7.1.6)
+      useragent (~> 0.16)
+    actiontext (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.1.6)
-      activesupport (= 7.1.6)
+    actionview (7.2.3.2)
+      activesupport (= 7.2.3.2)
       builder (~> 3.1)
       cgi
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.1.6)
-      activesupport (= 7.1.6)
+    activejob (7.2.3.2)
+      activesupport (= 7.2.3.2)
       globalid (>= 0.3.6)
-    activemodel (7.1.6)
-      activesupport (= 7.1.6)
-    activerecord (7.1.6)
-      activemodel (= 7.1.6)
-      activesupport (= 7.1.6)
+    activemodel (7.2.3.2)
+      activesupport (= 7.2.3.2)
+    activerecord (7.2.3.2)
+      activemodel (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       timeout (>= 0.4.0)
-    activestorage (7.1.6)
-      actionpack (= 7.1.6)
-      activejob (= 7.1.6)
-      activerecord (= 7.1.6)
-      activesupport (= 7.1.6)
+    activestorage (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       marcel (~> 1.0)
-    activesupport (7.1.6)
+    activesupport (7.2.3.2)
       base64
       benchmark (>= 0.3)
       bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.0.2)
+      concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
       logger (>= 1.4.2)
-      minitest (>= 5.1)
-      mutex_m
+      minitest (>= 5.1, < 6)
       securerandom (>= 0.3)
-      tzinfo (~> 2.0)
-    addressable (2.8.6)
-      public_suffix (>= 2.0.2, < 6.0)
+      tzinfo (~> 2.0, >= 2.0.5)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     aes_key_wrap (1.1.0)
     annotate (3.2.0)
       activerecord (>= 3.2, < 8.0)
       rake (>= 10.4, < 14.0)
-    ast (2.4.2)
+    ast (2.4.3)
     attr_required (1.0.2)
     authie (5.0.0)
       activerecord (>= 6.1, < 9.0)
-    autoprefixer-rails (10.4.13.0)
+    autoprefixer-rails (10.4.21.0)
       execjs (~> 2)
     base64 (0.3.0)
-    bcrypt (3.1.20)
+    bcrypt (3.1.22)
     benchmark (0.5.0)
-    bigdecimal (4.1.2)
-    bindata (2.5.0)
+    bigdecimal (4.1.3)
+    bindata (3.0.0)
     builder (3.3.0)
-    cgi (0.5.1)
+    cgi (0.5.2)
     chronic (0.10.2)
     coffee-rails (5.0.0)
       coffee-script (>= 2.2.0)
@@ -108,71 +102,74 @@ GEM
       coffee-script-source
       execjs
     coffee-script-source (1.12.2)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
-    crack (1.0.0)
+    crack (1.0.1)
       bigdecimal
       rexml
-    crass (1.0.6)
+    crass (1.0.7)
     database_cleaner-active_record (2.2.2)
       activerecord (>= 5.a)
       database_cleaner-core (~> 2.0)
-    database_cleaner-core (2.0.1)
+    database_cleaner-core (2.1.0)
     date (3.5.1)
     diff-lcs (1.6.2)
-    domain_name (0.6.20240107)
-    dotenv (3.0.2)
+    domain_name (0.6.20260907)
+    dotenv (3.2.0)
     drb (2.2.3)
-    dynamic_form (1.2.0)
-    email_validator (2.2.4)
-      activemodel
-    erb (6.0.4)
+    erb (6.0.7)
     erubi (1.13.1)
-    execjs (2.7.0)
-    factory_bot (6.4.6)
-      activesupport (>= 5.0.0)
-    factory_bot_rails (6.4.3)
-      factory_bot (~> 6.4)
-      railties (>= 5.0.0)
-    faraday (2.9.0)
-      faraday-net_http (>= 2.0, < 3.2)
-    faraday-follow_redirects (0.3.0)
+    execjs (2.10.2)
+      json (>= 2)
+    factory_bot (6.6.0)
+      activesupport (>= 6.1.0)
+    factory_bot_rails (6.5.1)
+      factory_bot (~> 6.5)
+      railties (>= 6.1.0)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-follow_redirects (0.5.0)
       faraday (>= 1, < 3)
-    faraday-net_http (3.1.0)
-      net-http
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
     ffi (1.15.5)
     gelf (3.1.0)
       json
-    globalid (1.3.0)
+    globalid (1.4.0)
       activesupport (>= 6.1)
-    haml (6.3.0)
+    haml (7.5.1)
+      prism (>= 1.1.0)
       temple (>= 0.8.2)
       thor
       tilt
-    hashdiff (1.1.0)
-    hashie (5.0.0)
-    highline (2.1.0)
-    i18n (1.14.8)
+    hashdiff (1.2.1)
+    hashie (5.1.0)
+      logger
+    highline (3.1.2)
+      reline
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    io-console (0.8.2)
+    io-console (0.9.2)
     irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    jquery-rails (4.5.1)
+    jquery-rails (4.6.1)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    json (2.7.1)
-    json-jwt (1.16.6)
+    json (2.21.2)
+    json-jwt (1.17.2)
       activesupport (>= 4.2)
       aes_key_wrap
       base64
       bindata
       faraday (~> 2.0)
       faraday-follow_redirects
-    jwt (2.8.1)
+    jwt (3.3.0)
       base64
     kaminari (1.2.2)
       activesupport (>= 4.1.0)
@@ -186,17 +183,19 @@ GEM
       activerecord
       kaminari-core (= 1.2.2)
     kaminari-core (1.2.2)
-    klogger-logger (1.4.0)
+    klogger-logger (1.5.0)
       concurrent-ruby (>= 1.0, < 2.0)
       json
       rouge (>= 3.30, < 5.0)
     konfig-config (3.0.0)
       hashie
+    language_server-protocol (3.17.0.6)
+    lint_roller (1.1.0)
     logger (1.7.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
       logger
       mini_mime (>= 0.1.1)
       net-imap
@@ -204,19 +203,18 @@ GEM
       net-smtp
     marcel (1.2.1)
     mini_mime (1.1.5)
-    minitest (6.0.6)
-      drb (~> 2.0)
-      prism (~> 1.5)
+    minitest (5.27.0)
     mutex_m (0.3.0)
-    mysql2 (0.5.6)
-    net-http (0.4.1)
-      uri
-    net-imap (0.6.4)
+    mysql2 (0.5.7)
+      bigdecimal
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    net-imap (0.6.7)
       date
       net-protocol
     net-pop (0.1.2)
       net-protocol
-    net-protocol (0.2.2)
+    net-protocol (0.3.0)
       timeout
     net-smtp (0.5.1)
       net-protocol
@@ -225,28 +223,28 @@ GEM
       activerecord (>= 4.0.0)
       activesupport (>= 4.0.0)
     nio4r (2.7.5)
-    nokogiri (1.19.3-aarch64-linux-gnu)
+    nokogiri (1.19.4-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.3-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-darwin)
+    nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
-    omniauth (2.1.2)
+    omniauth (2.1.4)
       hashie (>= 3.4.6)
+      logger
       rack (>= 2.2.3)
       rack-protection
-    omniauth-rails_csrf_protection (1.0.1)
+    omniauth-rails_csrf_protection (2.0.1)
       actionpack (>= 4.2)
       omniauth (~> 2.0)
-    omniauth_openid_connect (0.7.1)
+    omniauth_openid_connect (0.8.0)
       omniauth (>= 1.9, < 3)
       openid_connect (~> 2.2)
-    openid_connect (2.3.0)
+    openid_connect (2.5.0)
       activemodel
       attr_required (>= 1.0.0)
-      email_validator
       faraday (~> 2.0)
       faraday-follow_redirects
       json-jwt (>= 1.16)
@@ -257,30 +255,29 @@ GEM
       validate_url
       webfinger (~> 2.0)
     ostruct (0.6.3)
-    parallel (1.22.1)
-    parser (3.2.1.1)
+    parallel (2.2.0)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
-    pp (0.6.3)
+      racc
+    pp (0.6.4)
       prettyprint
     prettyprint (0.2.0)
     prism (1.9.0)
-    prometheus-client (4.2.2)
-    psych (5.4.0)
-      date
-      stringio
-    public_suffix (5.0.4)
-    puma (7.0.4)
+    prometheus-client (5.0.0)
+      base64
+    public_suffix (7.0.5)
+    puma (8.0.2)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.2.6)
-    rack-oauth2 (2.2.1)
+    rack (3.2.7)
+    rack-oauth2 (2.3.0)
       activesupport
       attr_required
       faraday (~> 2.0)
       faraday-follow_redirects
       json-jwt (>= 1.11.0)
       rack (>= 2.1.0)
-    rack-protection (4.1.1)
+    rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
       rack (>= 3.0.0, < 4)
@@ -291,32 +288,32 @@ GEM
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (7.1.6)
-      actioncable (= 7.1.6)
-      actionmailbox (= 7.1.6)
-      actionmailer (= 7.1.6)
-      actionpack (= 7.1.6)
-      actiontext (= 7.1.6)
-      actionview (= 7.1.6)
-      activejob (= 7.1.6)
-      activemodel (= 7.1.6)
-      activerecord (= 7.1.6)
-      activestorage (= 7.1.6)
-      activesupport (= 7.1.6)
+    rails (7.2.3.2)
+      actioncable (= 7.2.3.2)
+      actionmailbox (= 7.2.3.2)
+      actionmailer (= 7.2.3.2)
+      actionpack (= 7.2.3.2)
+      actiontext (= 7.2.3.2)
+      actionview (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activemodel (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       bundler (>= 1.15.0)
-      railties (= 7.1.6)
+      railties (= 7.2.3.2)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.1.6)
-      actionpack (= 7.1.6)
-      activesupport (= 7.1.6)
+    railties (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       cgi
-      irb
+      irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
       thor (~> 1.0, >= 1.2.2)
@@ -324,53 +321,62 @@ GEM
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
     rake (13.4.2)
-    rdoc (7.2.0)
-      erb
-      psych (>= 4.0.0)
+    rbs (4.2.0)
+      logger
+      prism (>= 1.6.0)
       tsort
-    regexp_parser (2.7.0)
-    reline (0.6.3)
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    regexp_parser (2.12.0)
+    reline (0.7.0)
       io-console (~> 0.5)
-    resolv (0.6.2)
+    resolv (0.7.2)
     rexml (3.4.4)
-    rouge (4.2.0)
-    rspec (3.13.1)
+    rouge (4.7.0)
+    rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.5)
+    rspec-core (3.13.6)
       rspec-support (~> 3.13.0)
     rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.5)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-rails (6.1.1)
-      actionpack (>= 6.1)
-      activesupport (>= 6.1)
-      railties (>= 6.1)
-      rspec-core (~> 3.12)
-      rspec-expectations (~> 3.12)
-      rspec-mocks (~> 3.12)
-      rspec-support (~> 3.12)
-    rspec-support (3.13.6)
-    rubocop (1.48.1)
-      json (~> 2.3)
-      parallel (~> 1.10)
-      parser (>= 3.2.0.0)
+    rspec-rails (8.0.4)
+      actionpack (>= 7.2)
+      activesupport (>= 7.2)
+      railties (>= 7.2)
+      rspec-core (>= 3.13.0, < 5.0.0)
+      rspec-expectations (>= 3.13.0, < 5.0.0)
+      rspec-mocks (>= 3.13.0, < 5.0.0)
+      rspec-support (>= 3.13.0, < 5.0.0)
+    rspec-support (3.13.7)
+    rubocop (1.91.0)
+      json (>= 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (>= 1.10)
+      parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.26.0, < 2.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.27.0)
-      parser (>= 3.2.1.0)
-    rubocop-rails (2.18.0)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.50.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    rubocop-rails (2.37.0)
       activesupport (>= 4.2.0)
+      lint_roller (~> 1.1)
       rack (>= 1.1)
-      rubocop (>= 1.33.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
+      rubocop-ast (>= 1.44.0, < 2.0)
     ruby-progressbar (1.13.0)
     sass-rails (6.0.0)
       sassc-rails (~> 2.1, >= 2.1.1)
@@ -382,32 +388,35 @@ GEM
       sprockets (> 3.0)
       sprockets-rails
       tilt
-    secure_headers (6.5.0)
+    secure_headers (7.3.0)
+      cgi (>= 0.1)
     securerandom (0.4.1)
-    sentry-rails (5.16.1)
-      railties (>= 5.0)
-      sentry-ruby (~> 5.16.1)
-    sentry-ruby (5.16.1)
+    sentry-rails (7.0.0)
+      railties (>= 5.2.0)
+      sentry-ruby (~> 7.0.0)
+    sentry-ruby (7.0.0)
+      bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
-    shoulda-matchers (6.1.0)
-      activesupport (>= 5.2.0)
-    sprockets (4.2.0)
-      concurrent-ruby (~> 1.0)
+      logger
+    shoulda-matchers (8.0.1)
+      activesupport (>= 7.2)
+    sprockets (4.4.1)
+      concurrent-ruby (~> 1.1)
+      logger
       rack (>= 2.2.4, < 4)
-    sprockets-rails (3.4.2)
-      actionpack (>= 5.2)
-      activesupport (>= 5.2)
+    sprockets-rails (3.5.2)
+      actionpack (>= 6.1)
+      activesupport (>= 6.1)
       sprockets (>= 3.0.0)
-    stringio (3.2.0)
     swd (2.0.3)
       activesupport (>= 3)
       attr_required (>= 0.0.5)
       faraday (~> 2.0)
       faraday-follow_redirects
-    temple (0.10.3)
+    temple (0.10.7)
     thor (1.5.0)
-    tilt (2.3.0)
-    timecop (0.9.8)
+    tilt (2.9.0)
+    timecop (0.9.11)
     timeout (0.6.1)
     tsort (0.2.0)
     turbolinks (5.2.1)
@@ -415,10 +424,13 @@ GEM
     turbolinks-source (5.2.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    uglifier (4.2.0)
+    uglifier (4.2.1)
       execjs (>= 0.3.0, < 3)
-    unicode-display_width (2.4.2)
-    uri (1.0.3)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
+    uri (1.1.1)
+    useragent (0.16.11)
     validate_url (1.0.15)
       activemodel (>= 3.0.0)
       public_suffix
@@ -426,16 +438,16 @@ GEM
       activesupport
       faraday (~> 2.0)
       faraday-follow_redirects
-    webmock (3.20.0)
+    webmock (3.26.4)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.9.1)
-    websocket-driver (0.8.0)
+    webrick (1.9.2)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
-    zeitwerk (2.8.2)
+    zeitwerk (2.8.3)
 
 PLATFORMS
   aarch64-linux
@@ -454,14 +466,14 @@ DEPENDENCIES
   database_cleaner-active_record
   domain_name
   dotenv
-  dynamic_form
-  execjs (~> 2.7, < 2.8)
+  execjs
   factory_bot_rails
   gelf
   haml
   hashie
   highline
   jquery-rails
+  json (< 3)
   jwt
   kaminari
   klogger-logger
@@ -479,7 +491,7 @@ DEPENDENCIES
   prometheus-client
   puma
   rackup
-  rails (= 7.1.6)
+  rails (= 7.2.3.2)
   resolv
   rspec
   rspec-rails
diff --git a/app/assets/stylesheets/application/components/_error_explanation.scss b/app/assets/stylesheets/application/components/_error_explanation.scss
index b45e912..76f102a 100644
--- a/app/assets/stylesheets/application/components/_error_explanation.scss
+++ b/app/assets/stylesheets/application/components/_error_explanation.scss
@@ -9,14 +9,6 @@
   line-height:1.5;
 }
 
-.errorExplanation h2 {
-  display:none;
-}
-
-.errorExplanation p {
-  display:none;
-}
-
 .errorExplanation ul li {
   list-style:disc;
   margin-left:20px;
diff --git a/app/helpers/error_messages_helper.rb b/app/helpers/error_messages_helper.rb
new file mode 100644
index 0000000..2285b1c
--- /dev/null
+++ b/app/helpers/error_messages_helper.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module ErrorMessagesHelper
+
+  # Renders a record's validation errors.
+  #
+  # This replaces the helper of the same name from the dynamic_form gem, which
+  # is unmaintained and cannot be installed on Ruby 3.4. The markup matches what
+  # that gem produced, minus the heading and description which the
+  # errorExplanation styles have always hidden, and matches the structure
+  # ajax.coffee builds when it renders errors from a remote form.
+  def error_messages_for(record)
+    record = record.to_model if record.respond_to?(:to_model)
+    return "".html_safe if record.nil? || record.errors.empty?
+
+    items = safe_join(record.errors.full_messages.map { |message| tag.li(message) })
+    tag.div(tag.ul(items), id: "errorExplanation", class: "errorExplanation")
+  end
+
+end
diff --git a/app/models/credential.rb b/app/models/credential.rb
index 98b2ddc..6f8fd4e 100644
--- a/app/models/credential.rb
+++ b/app/models/credential.rb
@@ -31,7 +31,7 @@ class Credential < ApplicationRecord
   validate :validate_key_cannot_be_changed
   validate :validate_key_for_smtp_ip
 
-  serialize :options, type: Hash
+  serialize :options, type: Hash, coder: YAML
 
   before_validation :generate_key
 
diff --git a/app/models/webhook_request.rb b/app/models/webhook_request.rb
index dfbf63e..d375d81 100644
--- a/app/models/webhook_request.rb
+++ b/app/models/webhook_request.rb
@@ -34,7 +34,7 @@ class WebhookRequest < ApplicationRecord
   validates :url, presence: true
   validates :event, presence: true
 
-  serialize :payload, type: Hash
+  serialize :payload, type: Hash, coder: YAML
 
   class << self
 
diff --git a/config/environments/test.rb b/config/environments/test.rb
index da3785d..281a97a 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -25,7 +25,7 @@ Rails.application.configure do
   config.action_controller.perform_caching = false
 
   # Raise exceptions instead of rendering exception templates.
-  config.action_dispatch.show_exceptions = false
+  config.action_dispatch.show_exceptions = :none
 
   # Disable request forgery protection in test environment.
   config.action_controller.allow_forgery_protection = false
diff --git a/config/initializers/form_builder_extensions.rb b/config/initializers/form_builder_extensions.rb
new file mode 100644
index 0000000..bfb6893
--- /dev/null
+++ b/config/initializers/form_builder_extensions.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+# Provides `f.error_messages` on form builders. This used to come from the
+# dynamic_form gem - see ErrorMessagesHelper for why that was removed.
+ActiveSupport.on_load(:action_view) do
+  ActionView::Helpers::FormBuilder.class_eval do
+    def error_messages
+      @template.error_messages_for(@object)
+    end
+  end
+end
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
deleted file mode 100644
index a13554e..0000000
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ /dev/null
@@ -1,142 +0,0 @@
-# frozen_string_literal: true
-# Be sure to restart your server when you modify this file.
-#
-# This file eases your Rails 7.0 framework defaults upgrade.
-#
-# Uncomment each configuration one by one to switch to the new default.
-# Once your application is ready to run with all new defaults, you can remove
-# this file and set the `config.load_defaults` to `7.0`.
-#
-# Read the Guide for Upgrading Ruby on Rails for more info on each option.
-# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
-
-# `button_to` view helper will render `<button>` element, regardless of whether
-# or not the content is passed as the first argument or as a block.
-# Rails.application.config.action_view.button_to_generates_button_tag = true
-
-# `stylesheet_link_tag` view helper will not render the media attribute by default.
-# Rails.application.config.action_view.apply_stylesheet_media_default = false
-
-# Change the digest class for the key generators to `OpenSSL::Digest::SHA256`.
-# Changing this default means invalidate all encrypted messages generated by
-# your application and, all the encrypted cookies. Only change this after you
-# rotated all the messages using the key rotator.
-#
-# See upgrading guide for more information on how to build a rotator.
-# https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html
-# Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
-
-# Change the digest class for ActiveSupport::Digest.
-# Changing this default means that for example Etags change and
-# various cache keys leading to cache invalidation.
-# Rails.application.config.active_support.hash_digest_class = OpenSSL::Digest::SHA256
-
-# Don't override ActiveSupport::TimeWithZone.name and use the default Ruby
-# implementation.
-# Rails.application.config.active_support.remove_deprecated_time_with_zone_name = true
-
-# Calls `Rails.application.executor.wrap` around test cases.
-# This makes test cases behave closer to an actual request or job.
-# Several features that are normally disabled in test, such as Active Record query cache
-# and asynchronous queries will then be enabled.
-# Rails.application.config.active_support.executor_around_test_case = true
-
-# Set both the `:open_timeout` and `:read_timeout` values for `:smtp` delivery method.
-# Rails.application.config.action_mailer.smtp_timeout = 5
-
-# The ActiveStorage video previewer will now use scene change detection to generate
-# better preview images (rather than the previous default of using the first frame
-# of the video).
-# Rails.application.config.active_storage.video_preview_arguments =
-#   "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2"
-
-# Automatically infer `inverse_of` for associations with a scope.
-# Rails.application.config.active_record.automatic_scope_inversing = true
-
-# Raise when running tests if fixtures contained foreign key violations
-# Rails.application.config.active_record.verify_foreign_keys_for_fixtures = true
-
-# Disable partial inserts.
-# This default means that all columns will be referenced in INSERT queries
-# regardless of whether they have a default or not.
-# Rails.application.config.active_record.partial_inserts = false
-
-# Protect from open redirect attacks in `redirect_back_or_to` and `redirect_to`.
-# Rails.application.config.action_controller.raise_on_open_redirects = true
-
-# Change the variant processor for Active Storage.
-# Changing this default means updating all places in your code that
-# generate variants to use image processing macros and ruby-vips
-# operations. See the upgrading guide for detail on the changes required.
-# The `:mini_magick` option is not deprecated; it's fine to keep using it.
-# Rails.application.config.active_storage.variant_processor = :vips
-
-# Enable parameter wrapping for JSON.
-# Previously this was set in an initializer. It's fine to keep using that initializer if you've customized it.
-# To disable parameter wrapping entirely, set this config to `false`.
-# Rails.application.config.action_controller.wrap_parameters_by_default = true
-
-# Specifies whether generated namespaced UUIDs follow the RFC 4122 standard for namespace IDs provided as a
-# `String` to `Digest::UUID.uuid_v3` or `Digest::UUID.uuid_v5` method calls.
-#
-# See https://guides.rubyonrails.org/configuring.html#config-active-support-use-rfc4122-namespaced-uuids for
-# more information.
-# Rails.application.config.active_support.use_rfc4122_namespaced_uuids = true
-
-# Change the default headers to disable browsers' flawed legacy XSS protection.
-# Rails.application.config.action_dispatch.default_headers = {
-#   "X-Frame-Options" => "SAMEORIGIN",
-#   "X-XSS-Protection" => "0",
-#   "X-Content-Type-Options" => "nosniff",
-#   "X-Download-Options" => "noopen",
-#   "X-Permitted-Cross-Domain-Policies" => "none",
-#   "Referrer-Policy" => "strict-origin-when-cross-origin"
-# }
-
-# ** Please read carefully, this must be configured in config/application.rb **
-# Change the format of the cache entry.
-# Changing this default means that all new cache entries added to the cache
-# will have a different format that is not supported by Rails 6.1 applications.
-# Only change this value after your application is fully deployed to Rails 7.0
-# and you have no plans to rollback.
-# When you're ready to change format, add this to `config/application.rb` (NOT this file):
-#  config.active_support.cache_format_version = 7.0
-
-# Cookie serializer: 2 options
-#
-# If you're upgrading and haven't set `cookies_serializer` previously, your cookie serializer
-# is `:marshal`. The default for new apps is `:json`.
-#
-# Rails.application.config.action_dispatch.cookies_serializer = :json
-#
-#
-# To migrate an existing application to the `:json` serializer, use the `:hybrid` option.
-#
-# Rails transparently deserializes existing (Marshal-serialized) cookies on read and
-# re-writes them in the JSON format.
-#
-# It is fine to use `:hybrid` long term; you should do that until you're confident *all* your cookies
-# have been converted to JSON. To keep using `:hybrid` long term, move this config to its own
-# initializer or to `config/application.rb`.
-#
-# Rails.application.config.action_dispatch.cookies_serializer = :hybrid
-#
-#
-# If your cookies can't yet be serialized to JSON, keep using `:marshal` for backward-compatibility.
-#
-# If you have configured the serializer elsewhere, you can remove this section of the file.
-#
-# See https://guides.rubyonrails.org/action_controller_overview.html#cookies for more information.
-
-# Change the return value of `ActionDispatch::Request#content_type` to the Content-Type header without modification.
-# Rails.application.config.action_dispatch.return_only_request_media_type_on_content_type = false
-
-# Active Storage `has_many_attached` relationships will default to replacing the current collection instead of appending to it.
-# Thus, to support submitting an empty collection, the `file_field` helper will render an hidden field `include_hidden` by default when `multiple_file_field_include_hidden` is set to `true`.
-# See https://guides.rubyonrails.org/configuring.html#config-active-storage-multiple-file-field-include-hidden for more information.
-# Rails.application.config.active_storage.multiple_file_field_include_hidden = true
-
-# ** Please read carefully, this must be configured in config/application.rb (NOT this file) **
-# Disables the deprecated #to_s override in some Ruby core classes
-# See https://guides.rubyonrails.org/configuring.html#config-active-support-disable-to-s-conversion for more information.
-# config.active_support.disable_to_s_conversion = true
diff --git a/config/initializers/new_framework_defaults_7_1.rb b/config/initializers/new_framework_defaults_7_1.rb
new file mode 100644
index 0000000..68c0884
--- /dev/null
+++ b/config/initializers/new_framework_defaults_7_1.rb
@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+#
+# This file eases your Rails 7.1 framework defaults upgrade.
+#
+# Uncomment each configuration one by one to switch to the new default.
+# Once your application is ready to run with all new defaults, you can remove
+# this file and set the `config.load_defaults` to `7.1`.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
+
+###
+# No longer add autoloaded paths into `$LOAD_PATH`. This means that you won't be able
+# to manually require files that are managed by the autoloader, which you shouldn't do anyway.
+#
+# This will reduce the size of the load path, making `require` faster if you don't use bootsnap, or reduce the size
+# of the bootsnap cache if you use it.
+#++
+# Rails.application.config.add_autoload_paths_to_load_path = false
+
+###
+# Remove the default X-Download-Options header since it is used only by Internet Explorer.
+# If you need to support Internet Explorer, add back `"X-Download-Options" => "noopen"`.
+#++
+# Rails.application.config.action_dispatch.default_headers = {
+#   "X-Frame-Options" => "SAMEORIGIN",
+#   "X-XSS-Protection" => "0",
+#   "X-Content-Type-Options" => "nosniff",
+#   "X-Permitted-Cross-Domain-Policies" => "none",
+#   "Referrer-Policy" => "strict-origin-when-cross-origin"
+# }
+
+###
+# Do not treat an `ActiveSupport::Duration` as a number of seconds when it is
+# used as a cache expiry. Raise instead, because the intent is ambiguous.
+#++
+# Rails.application.config.active_support.raise_on_invalid_cache_expiration_time = true
+
+###
+# Specify the default serializer used by `MessageEncryptor` and `MessageVerifier`
+# instances.
+#
+# The legacy default is `:marshal`, which is a potential vector for
+# deserialization attacks in cases where a message signing secret has been
+# leaked.
+#
+# In Rails 7.1, the new default is `:json_allow_marshal`, which serializes and
+# deserializes with `ActiveSupport::JSON`, but can fall back to deserializing
+# with `Marshal` so that legacy messages can still be read.
+#
+# In Rails 7.2, the default will become `:json`, which serializes and
+# deserializes with `ActiveSupport::JSON` only.
+#
+# Alternatively, you can choose `:message_pack` or `:message_pack_allow_marshal`,
+# which serialize with `ActiveSupport::MessagePack`. `ActiveSupport::MessagePack`
+# can roundtrip some Ruby types that are not supported by JSON, and may provide
+# improved performance, but it requires the `msgpack` gem.
+#
+# For more information, see
+# https://guides.rubyonrails.org/v7.1/configuring.html#config-active-support-message-serializer
+#
+# NOTE: Changing this affects the session cookie and any other signed or
+# encrypted message. Deploy `:json_allow_marshal` everywhere before considering
+# `:json`, and be aware that rolling back to a version which cannot read the new
+# format will invalidate existing sessions.
+#++
+# Rails.application.config.active_support.message_serializer = :json_allow_marshal
+
+###
+# Enable a performance optimization that serializes message data and metadata
+# together. This changes the message format, so messages serialized this way
+# cannot be read by older versions of Rails. However, messages that use the old
+# format can still be read, regardless of whether this optimization is enabled.
+#
+# To perform a rolling deploy of a Rails 7.1 upgrade, wherein servers that have
+# not yet been upgraded must be able to read messages from upgraded servers, leave
+# this optimization off on the first deploy, then enable it on a subsequent deploy.
+#++
+# Rails.application.config.active_support.use_message_serializer_for_metadata = true
+
+###
+# Set the maximum size for Rails log files.
+#
+# `config.load_defaults "7.1"` does not set this value for environments other than
+# development and test.
+#++
+# if Rails.env.local?
+#   Rails.application.config.log_file_size = 100 * 1024 * 1024
+# end
+
+###
+# Enable raising on assignment to attr_readonly attributes. The previous behavior
+# would allow assignment but silently not persist changes to the database.
+#++
+# Rails.application.config.active_record.raise_on_assign_to_attr_readonly = true
+
+###
+# Enable validating only parent-related columns for presence when the parent is mandatory.
+# The previous behavior was to validate the presence of the parent record, which performed an extra query
+# to get the parent every time the child record was updated, even when parent has not changed.
+#++
+# Rails.application.config.active_record.belongs_to_required_validates_foreign_key = false
+
+###
+# Enable preloading of the `before_committed!` callbacks on all records in a transaction,
+# instead of only the first copy of a record.
+#++
+# Rails.application.config.active_record.before_committed_on_all_records = true
+
+###
+# Disable deprecated singular associations names.
+#++
+# Rails.application.config.active_record.allow_deprecated_singular_associations_name = false
+
+###
+# Enable running `after_commit` callbacks in the order they are defined,
+# rather than in reverse order.
+#++
+# Rails.application.config.active_record.run_after_transaction_callbacks_in_order_defined = true
+
+###
+# Run `after_commit` and `after_rollback` callbacks on the first saved instance
+# of a record in a transaction, rather than the instance which was saved last.
+#++
+# Rails.application.config.active_record.run_commit_callbacks_on_first_saved_instances_in_transaction = false
+
+###
+# Configure the query log tags to use the SQLCommenter format.
+#++
+# Rails.application.config.active_record.query_log_tags_format = :sqlcommenter
+
+###
+# Specify the default serializer used by `ActiveRecord::Base#serialize`.
+#
+# `nil` means there is no default, so every `serialize` call must declare its
+# `coder:` explicitly. This app already does that, so this option is safe to
+# enable. Do not remove those explicit coders.
+#++
+# Rails.application.config.active_record.default_column_serializer = nil
+
+###
+# Use a 7.1-compatible marshalling format when caching Active Record objects.
+#
+# This format is more efficient, but cannot be read by Rails 7.0 and earlier, so
+# do not enable this until every process is running 7.1 or later.
+#++
+# Rails.application.config.active_record.marshalling_format_version = 7.1
+
+###
+# Generate a `has_secure_token` value when the record is initialized rather than
+# when it is created.
+#++
+# Rails.application.config.active_record.generate_secure_token_on = :initialize
+
+###
+# Use a modern HTML5 sanitizer (via Nokogiri's HTML5 parser) rather than the
+# legacy HTML4 one, where it is supported.
+#
+# This changes how malformed markup is parsed and sanitized. Review anywhere the
+# application sanitizes user-supplied HTML before enabling it.
+#++
+# Rails.application.config.action_view.sanitizer_vendor = Rails::HTML::Sanitizer.best_supported_vendor
+
+###
+# Parse HTML in tests with an HTML5 parser rather than an HTML4 one.
+#++
+# Rails.application.config.dom_testing_default_html_version = :html5
+
+###
+# Precompile the filter parameters (`config.filter_parameters`) so that filtering
+# is faster at request time.
+#++
+# Rails.application.config.precompile_filter_parameters = true
+
+###
+# Log exceptions that are handled by `rescue_from` (or otherwise rendered as an
+# error page) at the `error` level rather than `fatal`.
+#++
+# Rails.application.config.action_dispatch.debug_exception_log_level = :error
+
+###
+# Change the cache entry format, so that new entries are written in a format
+# which Rails 7.0 and earlier cannot read.
+#
+# Only enable this once every process is running 7.1 or later, and you have no
+# plans to roll back.
+#++
+# Rails.application.config.active_support.cache_format_version = 7.1
+
+###
+# Use SHA-256 to derive Active Record Encryption keys and stop supporting SHA-1
+# for non-deterministic encryption.
+#
+# This app does not currently use Active Record Encryption. If that changes,
+# read the upgrade guide before enabling these.
+#++
+# Rails.application.config.active_record.encryption.hash_digest_class = OpenSSL::Digest::SHA256
+# Rails.application.config.active_record.encryption.support_sha1_for_non_deterministic_encryption = false
diff --git a/config/initializers/new_framework_defaults_7_2.rb b/config/initializers/new_framework_defaults_7_2.rb
new file mode 100644
index 0000000..0344a6d
--- /dev/null
+++ b/config/initializers/new_framework_defaults_7_2.rb
@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+#
+# This file eases your Rails 7.2 framework defaults upgrade.
+#
+# Uncomment each configuration one by one to switch to the new default.
+# Once your application is ready to run with all new defaults, you can remove
+# this file and set the `config.load_defaults` to `7.2`.
+#
+# Read the Guide for Upgrading Ruby on Rails for more info on each option.
+# https://guides.rubyonrails.org/upgrading_ruby_on_rails.html
+
+###
+# Controls whether Active Job's `#perform_later` and similar methods automatically defer
+# the job queuing to after the current Active Record transaction is committed.
+#
+# Example:
+#   Topic.transaction do
+#     topic = Topic.create(...)
+#     NewTopicNotificationJob.perform_later(topic)
+#   end
+#
+# In this example, if the configuration is set to `:never`, the job will
+# be enqueued immediately, even though the `Topic` hasn't been committed yet.
+# Because of this, if the job is picked up almost immediately, or if the
+# transaction doesn't succeed for some reason, the job will fail to find this
+# topic in the database.
+#
+# If `enqueue_after_transaction_commit` is set to `:default`, the queue adapter
+# will define the behaviour.
+#
+# Note: Active Job backends can disable this feature. This is generally done by
+# backends that use the same database as Active Record as a queue, hence they
+# don't need this feature.
+#++
+# Rails.application.config.active_job.enqueue_after_transaction_commit = :default
+
+###
+# Adds image/webp to the list of content types Active Storage considers as an image
+# Prevents automatic conversion to a fallback PNG, and assumes clients support WebP, as they support gif, jpeg, and png.
+# This is possible due to broad browser support for WebP, but older browsers and email clients may still not support
+# WebP. Requires imagemagick/libvips built with WebP support.
+#++
+# Rails.application.config.active_storage.web_image_content_types = %w[image/png image/jpeg image/gif image/webp]
+
+###
+# Enable validation of migration timestamps. When set, an ActiveRecord::InvalidMigrationTimestampError
+# will be raised if the timestamp prefix for a migration is more than a day ahead of the timestamp
+# associated with the current time. This is done to prevent forward-dating of migration files, which can
+# impact migration generation and other migration commands.
+#
+# Applications with existing timestamped migrations that do not adhere to the
+# expected format can disable validation by setting this config to `false`.
+#++
+# Rails.application.config.active_record.validate_migration_timestamps = true
+
+###
+# Controls whether the PostgresqlAdapter should decode dates automatically with manual queries.
+#
+# Example:
+#   ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.select_value("select '2024-01-01'::date") #=> Date
+#
+# This query used to return a `String`.
+#++
+# Rails.application.config.active_record.postgresql_adapter_decode_dates = true
+
+###
+# Enables YJIT as of Ruby 3.3, to bring sizeable performance improvements. If you are
+# deploying to a memory constrained environment you may want to set this to `false`.
+#++
+# Rails.application.config.yjit = true
diff --git a/lib/migration_waiter.rb b/lib/migration_waiter.rb
index 36b36e0..6076121 100644
--- a/lib/migration_waiter.rb
+++ b/lib/migration_waiter.rb
@@ -15,7 +15,7 @@ class MigrationWaiter
     def wait
       attempts_remaining = ATTEMPTS
       loop do
-        pending_migrations = ActiveRecord::Base.connection.migration_context.open.pending_migrations.size
+        pending_migrations = pending_migration_count
         if pending_migrations.zero?
           Postal.logger.info "no pending migrations, continuing"
           return
@@ -33,6 +33,12 @@ class MigrationWaiter
       end
     end
 
+    # Returns the number of migrations which exist in the application but have
+    # not yet been applied to the database.
+    def pending_migration_count
+      ActiveRecord::Base.connection_pool.migration_context.open.pending_migrations.size
+    end
+
     def wait_if_appropriate
       # Don't wait if not configured
       return unless Postal::Config.migration_waiter.enabled?
diff --git a/spec/helpers/error_messages_helper_spec.rb b/spec/helpers/error_messages_helper_spec.rb
new file mode 100644
index 0000000..b1a3f26
--- /dev/null
+++ b/spec/helpers/error_messages_helper_spec.rb
@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe ErrorMessagesHelper, type: :helper do
+  describe "#error_messages_for" do
+    let(:user) { User.new }
+
+    context "when the record has no errors" do
+      it "renders nothing" do
+        expect(helper.error_messages_for(user)).to eq ""
+      end
+    end
+
+    context "when the record is nil" do
+      it "renders nothing" do
+        expect(helper.error_messages_for(nil)).to eq ""
+      end
+    end
+
+    context "when the record has errors" do
+      before do
+        user.valid?
+      end
+
+      it "renders the errorExplanation container the stylesheet targets" do
+        html = helper.error_messages_for(user)
+        expect(html).to include %(<div id="errorExplanation" class="errorExplanation">)
+      end
+
+      it "renders each full message as a list item" do
+        html = helper.error_messages_for(user)
+        user.errors.full_messages.each do |message|
+          expect(html).to include "<li>#{ERB::Util.html_escape(message)}</li>"
+        end
+      end
+
+      it "renders one list item per error" do
+        html = helper.error_messages_for(user)
+        expect(html.scan("<li>").size).to eq user.errors.count
+      end
+
+      it "returns an html_safe string" do
+        expect(helper.error_messages_for(user)).to be_html_safe
+      end
+    end
+
+    context "when an error message contains HTML" do
+      before do
+        user.errors.add(:base, %q(x'"><script>alert(1)</script>))
+      end
+
+      it "escapes it rather than emitting it verbatim" do
+        html = helper.error_messages_for(user)
+        expect(html).to_not include "<script>alert(1)</script>"
+        expect(html).to include "&lt;script&gt;alert(1)&lt;/script&gt;"
+      end
+    end
+  end
+end
diff --git a/spec/lib/json_encoding_spec.rb b/spec/lib/json_encoding_spec.rb
new file mode 100644
index 0000000..9ce66d6
--- /dev/null
+++ b/spec/lib/json_encoding_spec.rb
@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+# Active Support 7.2 calls `JSON.generate(..., quirks_mode: true)` and
+# `JSON.parse(json, quirks_mode: true)`. The json gem removed `quirks_mode` in
+# 3.0, so an unpinned json resolves to 3.x and every `to_json` in the app raises
+# ArgumentError - webhook payloads and JSON API responses included. The Gemfile
+# pins json to < 3 because of this; these examples fail loudly if that pin is
+# removed before we are on a Rails version that no longer passes the option.
+RSpec.describe "JSON encoding" do
+  it "encodes a hash" do
+    expect({ "a" => 1 }.to_json).to eq '{"a":1}'
+  end
+
+  it "encodes nested structures with mixed types" do
+    payload = { "event" => "MessageSent", "timestamp" => 1.5, "payload" => { "list" => [1, "two", nil, true] } }
+    expect(JSON.parse(payload.to_json)).to eq payload
+  end
+
+  it "round trips through Active Support's encoder" do
+    payload = { "uuid" => "abc-123", "nested" => { "x" => [1, 2] } }
+    expect(ActiveSupport::JSON.decode(ActiveSupport::JSON.encode(payload))).to eq payload
+  end
+
+  it "encodes a bare value, which is what quirks_mode allowed" do
+    expect(ActiveSupport::JSON.encode("hello")).to eq '"hello"'
+    expect(ActiveSupport::JSON.encode(42)).to eq "42"
+  end
+
+  it "encodes times the way the webhook payload relies on" do
+    expect(Time.at(1_700_000_000).utc.to_f.to_json).to eq "1700000000.0"
+  end
+end
diff --git a/spec/lib/migration_waiter_spec.rb b/spec/lib/migration_waiter_spec.rb
new file mode 100644
index 0000000..a0684f4
--- /dev/null
+++ b/spec/lib/migration_waiter_spec.rb
@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "migration_waiter"
+
+RSpec.describe MigrationWaiter do
+  describe ".pending_migration_count" do
+    # This talks to Active Record's migration APIs directly and is the part of
+    # this class most likely to break on a Rails upgrade (the call moved from
+    # the connection to the connection pool in Rails 7.2). The rest of this
+    # class is stubbed, so this example is what actually exercises it.
+    it "returns the number of migrations which have not been applied" do
+      expect(described_class.pending_migration_count).to be_a Integer
+    end
+
+    it "returns zero when the test database is up to date" do
+      expect(described_class.pending_migration_count).to eq 0
+    end
+  end
+
+  describe ".wait" do
+    before do
+      allow(Postal.logger).to receive(:info)
+      allow(described_class).to receive(:sleep)
+    end
+
+    it "returns immediately when there are no pending migrations" do
+      allow(described_class).to receive(:pending_migration_count).and_return(0)
+      described_class.wait
+      expect(described_class).to have_received(:pending_migration_count).once
+      expect(described_class).to_not have_received(:sleep)
+    end
+
+    it "waits until there are no pending migrations remaining" do
+      allow(described_class).to receive(:pending_migration_count).and_return(2, 1, 0)
+      described_class.wait
+      expect(described_class).to have_received(:sleep).with(described_class::SLEEP_TIME).twice
+    end
+
+    it "exits when migrations are still pending after the maximum number of attempts" do
+      stub_const("#{described_class}::ATTEMPTS", 3)
+      allow(described_class).to receive(:pending_migration_count).and_return(1)
+      # Process.exit raises SystemExit for real. It has to do so here too,
+      # otherwise the wait loop never terminates.
+      allow(Process).to receive(:exit).and_raise(SystemExit)
+
+      expect { described_class.wait }.to raise_error(SystemExit)
+
+      expect(Process).to have_received(:exit).with(1)
+      expect(described_class).to have_received(:sleep).twice
+    end
+  end
+
+  describe ".wait_if_appropriate" do
+    before do
+      allow(described_class).to receive(:wait)
+      allow(described_class).to receive(:console?).and_return(false)
+      allow(described_class).to receive(:rake_task?).and_return(false)
+      allow(described_class).to receive(:rails_command?).and_return(false)
+    end
+
+    context "when the migration waiter is not enabled" do
+      it "does not wait" do
+        allow(Postal::Config.migration_waiter).to receive(:enabled?).and_return(false)
+        described_class.wait_if_appropriate
+        expect(described_class).to_not have_received(:wait)
+      end
+    end
+
+    context "when the migration waiter is enabled" do
+      before do
+        allow(Postal::Config.migration_waiter).to receive(:enabled?).and_return(true)
+      end
+
+      it "waits" do
+        described_class.wait_if_appropriate
+        expect(described_class).to have_received(:wait)
+      end
+
+      %w[console? rake_task? rails_command?].each do |predicate|
+        it "does not wait when #{predicate.delete_suffix('?')} is true" do
+          allow(described_class).to receive(predicate).and_return(true)
+          described_class.wait_if_appropriate
+          expect(described_class).to_not have_received(:wait)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/models/serialized_columns_spec.rb b/spec/models/serialized_columns_spec.rb
new file mode 100644
index 0000000..717027f
--- /dev/null
+++ b/spec/models/serialized_columns_spec.rb
@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+# Active Record's serialization defaults have changed across recent Rails
+# releases (`config.active_record.default_column_serializer` becomes `nil` in
+# the 7.1 defaults, which makes an implicit coder an error rather than YAML).
+# These columns hold data written by older versions of Postal, so the on-disk
+# format has to stay YAML. These examples pin both the format and the round trip
+# so a future framework defaults bump cannot change them silently.
+RSpec.describe "serialized columns" do
+  shared_examples "a YAML serialized hash column" do |attribute|
+    let(:value) { { "string" => "value", "number" => 123, "nested" => { "a" => [1, 2] } } }
+
+    def write_raw(record, attribute, raw)
+      sql = described_class.sanitize_sql_array(
+        ["UPDATE #{described_class.table_name} SET #{attribute} = ? WHERE id = ?", raw, record.id]
+      )
+      described_class.connection.update(sql)
+    end
+
+    def read_raw(record, attribute)
+      described_class.connection.select_value(
+        described_class.sanitize_sql_array(
+          ["SELECT #{attribute} FROM #{described_class.table_name} WHERE id = ?", record.id]
+        )
+      )
+    end
+
+    it "defaults to an empty hash" do
+      expect(described_class.new.public_send(attribute)).to eq({})
+    end
+
+    it "round trips a hash through the database" do
+      record.update!(attribute => value)
+      expect(record.reload.public_send(attribute)).to eq value
+    end
+
+    it "stores the value as YAML in the database" do
+      record.update!(attribute => value)
+      raw = read_raw(record, attribute)
+
+      expect(raw).to be_a String
+      expect(YAML.safe_load(raw)).to eq value
+    end
+
+    it "reads YAML which was written by a previous version of Postal" do
+      write_raw(record, attribute, value.to_yaml)
+      expect(record.reload.public_send(attribute)).to eq value
+    end
+
+    it "rejects a value which is not a hash" do
+      expect { record.update!(attribute => "not a hash") }.to raise_error ActiveRecord::SerializationTypeMismatch
+    end
+  end
+
+  describe Credential do
+    let(:record) { create(:credential) }
+
+    include_examples "a YAML serialized hash column", :options
+  end
+
+  describe WebhookRequest do
+    let(:record) { create(:webhook_request) }
+
+    include_examples "a YAML serialized hash column", :payload
+  end
+end
diff --git a/spec/requests/rendering_spec.rb b/spec/requests/rendering_spec.rb
new file mode 100644
index 0000000..a9fb808
--- /dev/null
+++ b/spec/requests/rendering_spec.rb
@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+# These examples exist to exercise the view layer end to end - HAML, the asset
+# pipeline, the layout, form helpers and the session middleware. The rest of the
+# request specs only assert on redirects, so without these nothing in the suite
+# would notice if a Rails upgrade broke rendering.
+RSpec.describe "rendering", type: :request do
+  before do
+    host! Postal::Config.postal.web_hostname
+  end
+
+  describe "the login page" do
+    it "renders" do
+      get "/login"
+
+      expect(response).to have_http_status(:ok)
+      expect(response.media_type).to eq "text/html"
+      expect(response.body).to include "<form"
+      expect(response.body).to include "password"
+    end
+
+    it "renders the layout including compiled assets" do
+      get "/login"
+
+      expect(response.body).to include "<html"
+      expect(response.body).to match(/<link[^>]+stylesheets?/i).or match(/<link[^>]+\.css/i)
+      expect(response.body).to match(/<script[^>]+\.js/i)
+    end
+  end
+
+  describe "when not authenticated" do
+    it "redirects to the login page" do
+      get "/"
+
+      expect(response).to redirect_to("/login?return_to=%2F")
+    end
+  end
+
+  describe "when authenticated" do
+    let(:user) { create(:user) }
+
+    before do
+      post "/login", params: { email_address: user.email_address, password: "passw0rd" }
+    end
+
+    it "renders the organizations index" do
+      get "/"
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include "<html"
+    end
+
+    it "renders the user settings page" do
+      get "/settings"
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include user.email_address
+    end
+
+    # `f.error_messages` and `error_messages_for` used to come from the
+    # dynamic_form gem. The app provides them itself now (see
+    # ErrorMessagesHelper and config/initializers/form_builder_extensions.rb),
+    # so the rendered output is our responsibility to keep working.
+    describe "a form which fails validation" do
+      before do
+        patch "/settings", params: {
+          password: "passw0rd",
+          user: { first_name: "", last_name: "Smith", email_address: user.email_address }
+        }
+      end
+
+      it "re-renders the form" do
+        expect(response).to have_http_status(:ok)
+      end
+
+      it "renders the validation errors in the errorExplanation container" do
+        expect(response.body).to include %(<div id="errorExplanation" class="errorExplanation">)
+        expect(response.body).to include "<li>First name can&#39;t be blank</li>"
+      end
+    end
+
+    it "does not render an error container on a form which has no errors" do
+      get "/settings"
+
+      expect(response.body).to_not include "errorExplanation"
+    end
+  end
+end
diff --git a/spec/requests/security_headers_spec.rb b/spec/requests/security_headers_spec.rb
new file mode 100644
index 0000000..790ad23
--- /dev/null
+++ b/spec/requests/security_headers_spec.rb
@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+# The security headers come from the secure_headers gem plus Rails' own
+# defaults, and both have changed them across major versions. Nothing else in
+# the suite looks at response headers, so pin them here.
+RSpec.describe "security headers", type: :request do
+  before do
+    host! Postal::Config.postal.web_hostname
+    get "/login"
+  end
+
+  it "responds successfully" do
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "sets X-Frame-Options to sameorigin" do
+    expect(response.headers["x-frame-options"]).to eq "sameorigin"
+  end
+
+  it "sets X-Content-Type-Options to nosniff" do
+    expect(response.headers["x-content-type-options"]).to eq "nosniff"
+  end
+
+  it "disables the legacy XSS auditor rather than enabling it" do
+    # secure_headers 7 changed this from "1; mode=block". `0` is correct: the
+    # legacy auditor is deprecated and blocking mode was itself exploitable.
+    expect(response.headers["x-xss-protection"]).to eq "0"
+  end
+
+  it "sets X-Permitted-Cross-Domain-Policies to none" do
+    expect(response.headers["x-permitted-cross-domain-policies"]).to eq "none"
+  end
+
+  describe "the content security policy" do
+    let(:csp) { response.headers["content-security-policy"] }
+
+    it "is present" do
+      expect(csp).to be_present
+    end
+
+    it "restricts script-src to self" do
+      expect(csp).to include "script-src 'self'"
+    end
+
+    it "restricts connect-src to self" do
+      expect(csp).to include "connect-src 'self'"
+    end
+
+    it "forbids object-src" do
+      expect(csp).to include "object-src 'none'"
+    end
+  end
+
+  describe "cookies" do
+    # Rack 3 returns set-cookie as a String for one cookie and an Array for
+    # several, so normalise before looking for a particular cookie.
+    def cookie_named(name)
+      Array(response.headers["set-cookie"]).flat_map { |v| v.split("\n") }.find { |c| c.start_with?("#{name}=") }
+    end
+
+    it "marks the browser id cookie httponly and samesite lax" do
+      expect(cookie_named("browser_id")).to include "httponly"
+      expect(cookie_named("browser_id")).to include "samesite=lax"
+    end
+
+    context "once logged in" do
+      let(:user) { create(:user) }
+
+      before do
+        post "/login", params: { email_address: user.email_address, password: "passw0rd" }
+      end
+
+      it "marks the authie session cookie httponly and samesite lax" do
+        expect(cookie_named("user_session")).to include "httponly"
+        expect(cookie_named("user_session")).to include "samesite=lax"
+      end
+
+      it "marks the rails session cookie httponly and samesite lax" do
+        expect(cookie_named("_postal_session")).to include "httponly"
+        expect(cookie_named("_postal_session")).to include "samesite=lax"
+      end
+    end
+  end
+end
diff --git a/spec/views/haml_templates_spec.rb b/spec/views/haml_templates_spec.rb
new file mode 100644
index 0000000..39dd216
--- /dev/null
+++ b/spec/views/haml_templates_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+require "haml"
+
+# Compiles every HAML template and checks the Ruby it produces actually parses.
+# A HAML major version bump changes the compiler, and the request specs only
+# render a handful of pages, so without this most of app/views is unverified
+# until someone visits the page in production.
+RSpec.describe "HAML templates" do
+  def compile(source)
+    # Wrapped in a method body because layouts use `yield`, which is not legal
+    # at the top level.
+    RubyVM::AbstractSyntaxTree.parse("def _template\n#{Haml::Engine.new.call(source)}\nend")
+  end
+
+  templates = Dir[Rails.root.join("app/views/**/*.haml")]
+
+  it "finds the templates to check" do
+    expect(templates.size).to be > 50
+  end
+
+  # Without this, a change in how HAML reports errors could quietly turn every
+  # example below into a no-op that passes on anything.
+  describe "the check itself" do
+    it "rejects a template whose Ruby does not parse" do
+      expect { compile("= foo(\n") }.to raise_error(SyntaxError)
+    end
+
+    it "rejects a template with a malformed attribute hash" do
+      expect { compile("%div{:a =>}\n") }.to raise_error(SyntaxError)
+    end
+
+    it "accepts a valid template" do
+      expect { compile("%div\n  %p hello\n") }.to_not raise_error
+    end
+  end
+
+  templates.each do |path|
+    relative = path.sub("#{Rails.root}/", "")
+
+    it "compiles #{relative}" do
+      expect { compile(File.read(path)) }.to_not raise_error
+    end
+  end
+end