diff --git a/Gemfile b/Gemfile
index d6b98b6b..782a6563 100644
--- a/Gemfile
+++ b/Gemfile
@@ -6,7 +6,7 @@ gem "addressable"
 gem "aws-sdk-core"
 gem "aws-sdk-s3"
 gem "bootsnap", require: false
-gem "carrierwave", "< 3" # pin at v2 to avoid breaking changes
+gem "carrierwave", "< 4" # pin at v2 to avoid breaking changes
 gem "carrierwave-mongoid", require: "carrierwave/mongoid"
 gem "gds-sso"
 gem "govuk_app_config"
diff --git a/Gemfile.lock b/Gemfile.lock
index 78640f9b..408f04a2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -92,18 +92,16 @@ GEM
     bson (4.15.0)
     builder (3.2.4)
     byebug (11.1.3)
-    carrierwave (2.2.4)
-      activemodel (>= 5.0.0)
-      activesupport (>= 5.0.0)
+    carrierwave (3.0.4)
+      activemodel (>= 6.0.0)
+      activesupport (>= 6.0.0)
       addressable (~> 2.6)
       image_processing (~> 1.1)
       marcel (~> 1.0.0)
-      mini_mime (>= 0.1.3)
       ssrf_filter (~> 1.0)
-    carrierwave-mongoid (1.4.0)
-      carrierwave (>= 0.8, < 3)
-      mongoid (>= 3.0, < 9.0)
-      mongoid-grid_fs (>= 1.3, < 3.0)
+    carrierwave-mongoid (0.1.0)
+      carrierwave
+      mongoid
     climate_control (1.2.0)
     concurrent-ruby (1.2.2)
     connection_pool (2.4.1)
@@ -129,7 +127,7 @@ GEM
       faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
     faraday-net_http (3.0.2)
-    ffi (1.15.5)
+    ffi (1.16.3)
     filelock (1.1.1)
     find_a_port (1.0.1)
     gds-api-adapters (88.2.0)
@@ -205,9 +203,9 @@ GEM
       net-smtp
     marcel (1.0.2)
     method_source (1.0.0)
-    mime-types (3.4.1)
+    mime-types (3.5.1)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2023.0218.1)
+    mime-types-data (3.2023.1003)
     mini_magick (4.12.0)
     mini_mime (1.1.5)
     mini_portile2 (2.8.4)
@@ -219,9 +217,6 @@ GEM
       concurrent-ruby (>= 1.0.5, < 2.0)
       mongo (>= 2.18.0, < 3.0.0)
       ruby2_keywords (~> 0.0.5)
-    mongoid-grid_fs (2.5.0)
-      mime-types (>= 1.0, < 4.0)
-      mongoid (>= 3.0, < 9.0)
     msgpack (1.6.0)
     multi_xml (0.6.0)
     net-imap (0.3.7)
@@ -641,7 +636,7 @@ GEM
       actionpack (>= 5.2)
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
-    ssrf_filter (1.1.1)
+    ssrf_filter (1.1.2)
     state_machines (0.5.0)
     state_machines-activemodel (0.8.0)
       activemodel (>= 5.1)
@@ -692,7 +687,7 @@ DEPENDENCIES
   bootsnap
   brakeman
   byebug
-  carrierwave (< 3)
+  carrierwave (< 4)
   carrierwave-mongoid
   climate_control
   database_cleaner