diff --git a/.ruby-version b/.ruby-version
index ef538c28..fa7adc7a 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-3.1.2
+3.3.5
diff --git a/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb b/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
index 6df3cb85..cef5b2a0 100644
--- a/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
+++ b/bosh-cli-v2-cf-cli/bosh-cli-v2-cf-cli_spec.rb
@@ -9,7 +9,7 @@
 BOSH_ENV_DEPS = "build-essential zlib1g-dev openssl libxslt1-dev libxml2-dev \
     libssl-dev libreadline8 libreadline-dev libyaml-dev libsqlite3-dev sqlite3"
 CF_ENV_DEPS = "unzip curl openssl ca-certificates git libc6 bash jq gettext make"
-RUBY_VERSION = "3.1"
+RUBY_VERSION = "3.3"
 
 describe "bosh-cli-v2-cf-cli image" do
   before(:all) {
diff --git a/bosh-cli-v2/Dockerfile b/bosh-cli-v2/Dockerfile
index 9f61136a..9ac0c1b0 100644
--- a/bosh-cli-v2/Dockerfile
+++ b/bosh-cli-v2/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.1-slim-bullseye
+FROM ruby:3.3-slim-bullseye@sha256:b2b83d827d32215b4a151c237b788406e7d996c85e3448bdd8e29e15a53257f8
 
 # renovate: datasource=github-releases depName=cloudfoundry/bosh-cli
 ENV BOSH_CLI_VERSION 7.6.1
diff --git a/bosh-cli-v2/bosh-cli-v2_spec.rb b/bosh-cli-v2/bosh-cli-v2_spec.rb
index 645e9d47..65486d85 100644
--- a/bosh-cli-v2/bosh-cli-v2_spec.rb
+++ b/bosh-cli-v2/bosh-cli-v2_spec.rb
@@ -4,7 +4,7 @@
 
 BOSH_CLI_VERSION="7.6.1" # renovate: datasource=github-releases depName=cloudfoundry/bosh-cli
 CREDHUB_CLI_VERSION='2.9.31' # renovate: datasource=github-releases depName=cloudfoundry/credhub-cli
-RUBY_VERSION = "3.1"
+RUBY_VERSION = "3.3"
 
 BOSH_ENV_DEPS = "build-essential zlib1g-dev openssl libxslt1-dev libxml2-dev \
     libssl-dev libreadline8 libreadline-dev libyaml-dev libsqlite3-dev sqlite3"
diff --git a/cf-cli/Dockerfile b/cf-cli/Dockerfile
index 0f2a99a5..f3dd7bf6 100644
--- a/cf-cli/Dockerfile
+++ b/cf-cli/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.1-alpine3.18
+FROM ruby:3.3-alpine3.18@sha256:d907735cff25973a6c904d3b221914fabb217f279c807c53a807d6668c6b2acb
 
 ENV PACKAGES "unzip curl openssl ca-certificates git libc6-compat bash jq gettext make"
 # renovate: datasource=github-releases depName=cloudfoundry/cli
diff --git a/cf-cli/cf-cli_spec.rb b/cf-cli/cf-cli_spec.rb
index e54722ec..888eaebe 100644
--- a/cf-cli/cf-cli_spec.rb
+++ b/cf-cli/cf-cli_spec.rb
@@ -5,7 +5,7 @@
 CF_CLI_VERSION="8.7.10" # renovate: datasource=github-releases depName=cloudfoundry/cli
 SPRUCE_BIN = "/usr/local/bin/spruce"
 SPRUCE_VERSION = "1.31.0" # renovate: datasource=github-releases depName=geofffranks/spruce
-RUBY_VERSION = "3.1"
+RUBY_VERSION = "3.3"
 
 describe "cf-cli image" do
   before(:all) {
diff --git a/k8s-tools/Dockerfile b/k8s-tools/Dockerfile
index 4c66df54..90d150ee 100644
--- a/k8s-tools/Dockerfile
+++ b/k8s-tools/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.1-slim
+FROM ruby:3.3-slim@sha256:7bb0e1e46378217ce0775845f6d64b039c56d2890bc715536e6687ab13fe2930
 
 # we use libc6 instead of libc6-compat as we do not use alpine base image
 ENV PACKAGES "unzip curl openssl ca-certificates git libc6 bash jq gettext"
diff --git a/k8s-tools/k8s-tools_spec.rb b/k8s-tools/k8s-tools_spec.rb
index a094e47b..cb279ad9 100644
--- a/k8s-tools/k8s-tools_spec.rb
+++ b/k8s-tools/k8s-tools_spec.rb
@@ -10,7 +10,7 @@
 KUBECTL_VERSION="1.26.15" # renovate: datasource=github-tags depName=kubernetes/kubectl
 HELM_VERSION="3.14.4" # renovate: datasource=github-releases depName=helm/helm
 KUTTL_VERSION="0.17.0" # renovate: datasource=github-releases depName=kudobuilder/kuttl
-RUBY_VERSION = "3.1"
+RUBY_VERSION = "3.3"
 
 DEPS = "unzip curl openssl ca-certificates git libc6 bash jq gettext"