diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba5393b4..1fd68f2f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
             database-password: 'root'
             database-port: '3306'
             docker-compose-file: 'docker-compose.ci.mysql.yml'
-          - ruby-version: 'jruby-9.4.15.0'
+          - ruby-version: 'jruby-10.0.6.0'
             database-adapter: 'mysql2'
             database-user: 'root'
             database-password: 'root'
@@ -36,7 +36,7 @@ jobs:
             database-password: 'postgres'
             database-port: '5432'
             docker-compose-file: 'docker-compose.ci.postgresql.yml'
-          - ruby-version: 'jruby-9.4.15.0'
+          - ruby-version: 'jruby-10.0.6.0'
             database-adapter: 'postgresql'
             database-user: 'postgres'
             database-password: 'postgres'
diff --git a/Gemfile b/Gemfile
index cf442b2a..c1fefec0 100644
--- a/Gemfile
+++ b/Gemfile
@@ -14,9 +14,17 @@ gem 'i18n', '~> 1.14.0'
 # Minitest 6.0.0 was released Dec 2024 with breaking API changes
 gem 'minitest', '~> 5.0'
 
+# json 3.0 dropped the quirks_mode keyword that ActiveSupport::JSON.encode
+# still passes to JSON.generate, raising ArgumentError (breaks any code path
+# that calls #to_json, e.g. killbill-client's model classes). This repo's
+# rubocop ~> 1.89.0 pin below happens to also constrain json < 3 (rubocop
+# 1.89.0 depends on json ~> 2.3), but rubocop 1.90.0 loosened that to
+# json >= 2.3 (no upper bound) - pin json explicitly so this doesn't depend
+# on the rubocop pin never changing.
+gem 'json', '~> 2.21'
+
 group :development do
   gem 'gem-release'
-  gem 'json'
   gem 'listen'
   gem 'multi_json'
   gem 'pry-rails'
diff --git a/README.md b/README.md
index 4c220121..27dc2e7c 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,7 @@ Kill Bill compatibility
 Dependencies
 ------------
 
-Ruby 3.1.0+ or JRuby 9.4.15.0+ required.
+Ruby 3.1.0+ or JRuby 10.0.6.0+ required.
 
 Running Kaui locally
 ---------------------
diff --git a/kaui.gemspec b/kaui.gemspec
index c16e96e3..dcd6cd22 100644
--- a/kaui.gemspec
+++ b/kaui.gemspec
@@ -26,6 +26,10 @@ Gem::Specification.new do |s|
   s.add_dependency 'cancan'
   s.add_dependency 'concurrent-ruby'
   s.add_dependency 'country_select'
+  # csv is a "bundled gem" as of Ruby 3.4 (no longer a default gem), so it
+  # must be an explicit dependency for it to be available via Bundler.require
+  # (affects controllers using CSV export). JRuby 10 targets Ruby 3.4+ compat.
+  s.add_dependency 'csv'
   s.add_dependency 'devise'
   s.add_dependency 'font-awesome-rails'
   s.add_dependency 'jquery-rails', '~> 4.5.1'
diff --git a/test/dummy/config/application.rb b/test/dummy/config/application.rb
index aa48bc75..82faf1ab 100644
--- a/test/dummy/config/application.rb
+++ b/test/dummy/config/application.rb
@@ -15,10 +15,8 @@
 require "rails/test_unit/railtie"
 require 'sprockets/railtie'
 
-# Work around a sorbet-runtime/js-routes crash under JRuby 10 (Ruby 4.0 compat):
-# js-routes' sig-decorated methods trigger a sorbet-runtime signature-validation
-# NoMethodError at load time. Disabling runtime checks avoids building the
-# crashing validation wrapper. See repo memory for details.
+# Work around a JRuby 10 bug (jruby/jruby#9651) that crashes sorbet-runtime's
+# signature validation (used by js-routes) at load time.
 if defined?(JRUBY_VERSION)
   require 'sorbet-runtime'
   T::Configuration.default_checked_level = :never