diff --git a/.ruby-version b/.ruby-version
index ef538c28..9c25013d 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.1.2
+3.3.6
diff --git a/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb b/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
index a7dd3411..c376d1f6 100644
--- a/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
+++ b/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
@@ -9,7 +9,7 @@
 BOSH_ENV_DEPS = "build-essential zlib1g-dev openssl libxslt1-dev libxml2-dev \
     libssl-dev libreadline8 libreadline-dev libyaml-dev libsqlite3-dev sqlite3"
 CF_ENV_DEPS = "unzip curl openssl ca-certificates git libc6 bash jq gettext make"
-RUBY_VERSION = "3.1"
+RUBY_VERSION = "3.3"
 
 describe "bosh-cli-v2-cf-cli image" do
   before(:all) {
diff --git a/bosh-cli-v2/Dockerfile b/bosh-cli-v2/Dockerfile
index 436ca472..4a107a07 100644
--- a/bosh-cli-v2/Dockerfile
+++ b/bosh-cli-v2/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.1-slim-bullseye
+FROM ruby:3.3-slim-bullseye@sha256:ed5212abc2cbfd77e5c8a2bd1f8ef4080e49222a3ac263ce66ca7a8bd14a026b
 
 # renovate: datasource=github-releases depName=cloudfoundry/bosh-cli
 ENV BOSH_CLI_VERSION 7.7.1
diff --git a/bosh-cli-v2/bosh-cli-v2_spec.rb b/bosh-cli-v2/bosh-cli-v2_spec.rb
index 51ebfd48..c3a43ae3 100644
--- a/bosh-cli-v2/bosh-cli-v2_spec.rb
+++ b/bosh-cli-v2/bosh-cli-v2_spec.rb
@@ -4,7 +4,7 @@
 
 BOSH_CLI_VERSION="7.7.1" # renovate: datasource=github-releases depName=cloudfoundry/bosh-cli
 CREDHUB_CLI_VERSION='2.9.36' # renovate: datasource=github-releases depName=cloudfoundry/credhub-cli
-RUBY_VERSION = "3.1"
+RUBY_VERSION = "3.3"
 
 BOSH_ENV_DEPS = "build-essential zlib1g-dev openssl libxslt1-dev libxml2-dev \
     libssl-dev libreadline8 libreadline-dev libyaml-dev libsqlite3-dev sqlite3"
diff --git a/cf-cli/Dockerfile b/cf-cli/Dockerfile
index dcf233e1..576d2e06 100644
--- a/cf-cli/Dockerfile
+++ b/cf-cli/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.1-alpine3.18
+FROM ruby:3.3-alpine3.18@sha256:d907735cff25973a6c904d3b221914fabb217f279c807c53a807d6668c6b2acb
 
 ENV PACKAGES "unzip curl openssl ca-certificates git libc6-compat bash jq gettext make"
 # renovate: datasource=github-releases depName=cloudfoundry/cli
diff --git a/cf-cli/cf-cli_spec.rb b/cf-cli/cf-cli_spec.rb
index e6273dc2..3b0328c3 100644
--- a/cf-cli/cf-cli_spec.rb
+++ b/cf-cli/cf-cli_spec.rb
@@ -5,7 +5,7 @@
 CF_CLI_VERSION="8.7.10" # renovate: datasource=github-releases depName=cloudfoundry/cli
 SPRUCE_BIN = "/usr/local/bin/spruce"
 SPRUCE_VERSION = "1.31.1" # renovate: datasource=github-releases depName=geofffranks/spruce
-RUBY_VERSION = "3.1"
+RUBY_VERSION = "3.3"
 
 describe "cf-cli image" do
   before(:all) {
diff --git a/k8s-tools/Dockerfile b/k8s-tools/Dockerfile
index fc03c474..1f2c590c 100644
--- a/k8s-tools/Dockerfile
+++ b/k8s-tools/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.1-slim
+FROM ruby:3.3-slim@sha256:25a9df53c6f23406f6bc87426ad5bd74b6d99423a8c2ca630f2443dee2447f53
 
 # we use libc6 instead of libc6-compat as we do not use alpine base image
 ENV PACKAGES "unzip curl openssl ca-certificates git libc6 bash jq gettext"
diff --git a/k8s-tools/k8s-tools_spec.rb b/k8s-tools/k8s-tools_spec.rb
index fc2dfef2..424a3bf1 100644
--- a/k8s-tools/k8s-tools_spec.rb
+++ b/k8s-tools/k8s-tools_spec.rb
@@ -10,7 +10,7 @@
 KUBECTL_VERSION="1.28.13" # renovate: datasource=github-tags depName=kubernetes/kubectl
 HELM_VERSION="3.14.4" # renovate: datasource=github-releases depName=helm/helm
 KUTTL_VERSION="0.19.0" # renovate: datasource=github-releases depName=kudobuilder/kuttl
-RUBY_VERSION = "3.1"
+RUBY_VERSION = "3.3"
 
 DEPS = "unzip curl openssl ca-certificates git libc6 bash jq gettext"