diff --git a/configs/components/openssl-3.5.json b/configs/components/openssl-3.5.json
new file mode 100644
index 00000000..bb74a0a7
--- /dev/null
+++ b/configs/components/openssl-3.5.json
@@ -0,0 +1,5 @@
+{
+  "version": "3.5.6",
+  "url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.6/openssl-3.5.6.tar.gz",
+  "sha256sum": "deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736"
+}
diff --git a/configs/components/openssl-3.5.rb b/configs/components/openssl-3.5.rb
new file mode 100644
index 00000000..25d79bc0
--- /dev/null
+++ b/configs/components/openssl-3.5.rb
@@ -0,0 +1,125 @@
+#####
+# Component release information:
+#   https://github.com/openssl/openssl/releases
+#   3.5 isn't latest openssl, but latest LTS: https://openssl-library.org/policies/releasestrat/index.html
+#####
+component 'openssl' do |pkg, settings, platform|
+  pkg.load_from_json('configs/components/openssl-3.5.json')
+  pkg.mirror "#{settings[:buildsources_url]}/openssl-#{pkg.get_version}.tar.gz"
+
+  #############################
+  # ENVIRONMENT, FLAGS, TARGETS
+  #############################
+
+  if platform.is_rpm? && !platform.is_sles?
+    pkg.build_requires 'perl-core'
+  else
+    pkg.build_requires 'perl'
+  end
+
+  target = ''
+  pkg.environment 'CFLAGS', settings[:cflags]
+  pkg.environment 'LDFLAGS', settings[:ldflags]
+
+  if platform.is_windows?
+    pkg.environment 'PATH', "$(shell cygpath -u #{settings[:gcc_bindir]}):$(PATH)"
+    pkg.environment 'CYGWIN', settings[:cygwin]
+    pkg.environment 'MAKE', platform[:make]
+
+    target = 'mingw64'
+  elsif platform.is_macos?
+    pkg.environment 'PATH', '$(PATH):/opt/homebrew/bin:/usr/local/bin'
+    pkg.environment 'CC', settings[:cc]
+    pkg.environment 'MACOSX_DEPLOYMENT_TARGET', settings[:deployment_target]
+
+    target = "darwin64-#{platform.architecture}"
+  elsif platform.is_linux?
+    pkg.environment 'PATH', '$(PATH):/usr/local/bin'
+
+    pkg.environment 'LDFLAGS', "#{settings[:ldflags]} -Wl,-z,relro"
+    case platform.architecture
+    when /aarch64$/
+      target = 'linux-aarch64'
+    when /64$/
+      target = 'linux-x86_64'
+    when 'armhf'
+      target = 'linux-armv4'
+    end
+  end
+
+  ####################
+  # BUILD REQUIREMENTS
+  ####################
+
+  pkg.build_requires "runtime-#{settings[:runtime_project]}"
+
+  ###########
+  # CONFIGURE
+  ###########
+
+  # Defining --libdir ensures that we avoid the multilib (lib/ vs. lib64/) problem,
+  # since configure uses the existence of a lib64 directory to determine
+  # if it should install its own libs into a multilib dir. Yay OpenSSL!
+  configure_flags = [
+    "--prefix=#{settings[:prefix]}",
+    '--libdir=lib',
+    "--openssldir=#{settings[:prefix]}/ssl",
+    'shared',
+    'no-gost',
+    target,
+    'no-camellia',
+    'no-md2',
+    'no-ssl3',
+    'no-ssl3-method',
+    'no-dtls1-method',
+    'no-dtls1_2-method',
+    'no-aria',
+    'no-bf',
+    'no-cast',
+    'no-des',
+    'no-rc5',
+    'no-mdc2',
+    'no-rmd160',
+    'no-whirlpool'
+  ]
+
+  configure_flags << 'no-legacy' << 'no-md4'
+
+  # Individual projects may provide their own openssl configure flags:
+  project_flags = settings[:openssl_extra_configure_flags] || []
+  configure_flags << project_flags
+
+  pkg.configure do
+    ["./Configure #{configure_flags.join(' ')}"]
+  end
+
+  #######
+  # BUILD
+  #######
+
+  build_commands = []
+
+  build_commands << "#{platform[:make]} depend"
+  build_commands << platform[:make]
+
+  pkg.build do
+    build_commands
+  end
+
+  #########
+  # INSTALL
+  #########
+
+  install_prefix = platform.is_windows? ? '' : 'INSTALL_PREFIX=/'
+  install_commands = []
+
+  # Skip man and html docs
+  install_commands << "#{platform[:make]} #{install_prefix} install_sw install_ssldirs"
+  install_commands << "rm -f #{settings[:prefix]}/bin/c_rehash"
+
+  pkg.install do
+    install_commands
+  end
+
+  pkg.install_file 'LICENSE.txt', "#{settings[:prefix]}/share/doc/openssl-#{pkg.get_version}/LICENSE"
+end
diff --git a/configs/components/ruby-4.0.json b/configs/components/ruby-4.0.json
new file mode 100644
index 00000000..8356525c
--- /dev/null
+++ b/configs/components/ruby-4.0.json
@@ -0,0 +1,4 @@
+{
+  "version": "4.0.3",
+  "sha256sum": "77964acc370d5c8375b9502e5ba6c13c03ef91ab9eb9f521c84fb42b9c9a6b0f"
+}
diff --git a/configs/components/ruby-4.0.rb b/configs/components/ruby-4.0.rb
new file mode 100644
index 00000000..38e64c7d
--- /dev/null
+++ b/configs/components/ruby-4.0.rb
@@ -0,0 +1,218 @@
+#####
+# Component release information:
+#   https://github.com/ruby/ruby/releases
+#   https://www.ruby-lang.org/en/downloads/releases/
+# Notes:
+#   The file name of the ruby component must match the ruby_version
+#####
+component 'ruby-4.0' do |pkg, settings, platform|
+  pkg.load_from_json('configs/components/ruby-4.0.json')
+
+  ruby_dir = settings[:ruby_dir]
+  ruby_bindir = settings[:ruby_bindir]
+  host_ruby = settings[:host_ruby]
+
+  # rbconfig-update is used to munge rbconfigs after the fact.
+  pkg.add_source('file://resources/files/ruby/rbconfig-update.rb')
+
+  # Most ruby configuration happens in the base ruby config:
+  instance_eval File.read('configs/components/_base-ruby.rb')
+
+  #########
+  # PATCHES
+  #########
+
+  # base = 'resources/patches/ruby_40'
+
+  # if platform.is_windows?
+  #  pkg.apply_patch "#{base}/windows_mingw32_mkmf.patch"
+  #  pkg.apply_patch "#{base}/ruby-faster-load_32.patch"
+  #  pkg.apply_patch "#{base}/revert_speed_up_rebuilding_loaded_feature_index.patch"
+  #  pkg.apply_patch "#{base}/revert-ruby-double-load-symlink.patch"
+  #  pkg.apply_patch "#{base}/revert_ruby_utf8_default_encoding.patch"
+  # end
+
+  # if platform.is_fips?
+  #  # This is needed on Ruby < 3.3 until the fix is backported (if ever)
+  #  # See: https://bugs.ruby-lang.org/issues/20000
+  #  pkg.apply_patch "#{base}/openssl3_fips.patch"
+  # end
+
+  ####################
+  # ENVIRONMENT, FLAGS
+  ####################
+
+  cflags = settings[:cflags]
+  cppflags = settings[:cppflags]
+  if platform.is_macos?
+    pkg.environment 'optflags', cflags
+    pkg.environment 'CFLAGS', cflags
+    pkg.environment 'CPPFLAGS', cppflags
+    pkg.environment 'LDFLAGS', settings[:ldflags]
+    pkg.environment 'CC', settings[:cc]
+    pkg.environment 'CXX', settings[:cxx]
+    pkg.environment 'MACOSX_DEPLOYMENT_TARGET', settings[:deployment_target]
+    pkg.environment 'PATH', '$(PATH):/opt/homebrew/bin:/usr/local/bin'
+  elsif platform.is_windows?
+    optflags = "#{cflags} -O3"
+    pkg.environment 'optflags', optflags
+    pkg.environment 'CFLAGS', optflags
+    pkg.environment 'MAKE', 'make'
+  else
+    pkg.environment 'optflags', '-O2'
+  end
+
+  special_flags = " --prefix=#{ruby_dir} --with-opt-dir=#{settings[:prefix]} "
+
+  if (platform.is_debian? && platform.os_version.to_i >= 13) || (platform.is_ubuntu? && platform.os_version.to_f >= 25.04 || platform.is_sles? && platform.os_version.to_i >= 16)
+    # A problem with --enable-dtrace, which I suspect may be because of GCC on the Trixie image.
+    # Check if this is still needed next time we bump Ruby and/or bump the Debian 13
+    # container to the release version.
+    cflags += ' -Wno-error=implicit-function-declaration '
+  end
+
+  special_flags += " CFLAGS='#{cflags}' LDFLAGS='#{settings[:ldflags]}' CPPFLAGS='#{settings[:cppflags]}' " if settings[:supports_pie]
+
+  # Ruby's build process requires a "base" ruby and we need a ruby to install
+  # gems into the /opt/puppetlabs/puppet/lib directory.
+  #
+  # For native compiles, we don't want ruby's build process to use whatever ruby
+  # is in the PATH, as it's probably too old to build ruby 4.0. And we don't
+  # want to use/maintain pl-ruby if we don't have to. Instead set baseruby to
+  # "no" which will force ruby to build and use miniruby.
+  special_flags += ' --with-baseruby=no '
+
+  if platform.is_windows?
+    # ruby's configure script guesses the build host is `cygwin`, because we're using
+    # cygwin opensshd & bash. So mkmf will convert compiler paths, e.g. -IC:/... to
+    # cygwin paths, -I/cygdrive/c/..., which confuses mingw-w64. So specify the build
+    # target explicitly.
+    special_flags += " CPPFLAGS='-DFD_SETSIZE=2048' debugflags=-g "
+
+    special_flags += ' --build x86_64-w64-mingw32 '
+  elsif platform.is_macos?
+    special_flags += " --with-openssl-dir=#{settings[:prefix]} "
+  end
+
+  without_dtrace = [
+    'macos-all-arm64',
+    'macos-all-x86_64',
+    'windows-all-x64'
+  ]
+
+  # sometimes dtrace will be enabled at compile time if the dtrace binary is present
+  special_flags += if without_dtrace.include? platform.name
+                     ' --enable-dtrace=no '
+                   else
+                     ' --enable-dtrace '
+                   end
+
+  ###########
+  # CONFIGURE
+  ###########
+  pkg.configure { ['bash autogen.sh'] }
+
+  # we want to provide the different just in time compilers where possible
+  # they require a modern rust version
+  # https://docs.ruby-lang.org/en/master/jit/zjit_md.html zjit: Rust 1.85.0
+  # https://docs.ruby-lang.org/en/master/jit/yjit_md.html yjit: Rust 1.58.0
+  platforms_without_rust = [
+    'debian-11-aarch64',
+    'debian-11-amd64',
+    'debian-12-aarch64',
+    'debian-12-amd64',
+    'debian-13-armhf',
+    'macos-all-arm64',
+    'macos-all-x86_64',
+    'sles-15-x86_64',
+    'sles-16-aarch64',
+    'sles-16-x86_64',
+    'ubuntu-22.04-aarch64',
+    'ubuntu-22.04-amd64',
+    'ubuntu-24.04-aarch64',
+    'ubuntu-24.04-amd64',
+    'ubuntu-24.04-armhf',
+    'ubuntu-25.04-aarch64',
+    'ubuntu-25.04-amd64',
+    'ubuntu-25.04-armhf',
+    'ubuntu-26.04-armhf',
+    'windows-all-x64'
+  ]
+  if platforms_without_rust.include? platform.name
+    configure_flags = ''
+  else
+    pkg.build_requires 'rustc'
+    configure_flags = '--enable-yjit --enable-zjit'
+  end
+  pkg.configure do
+    [
+      "bash configure \
+        --enable-shared \
+        --disable-install-doc \
+        --disable-install-rdoc \
+        #{settings[:host]} \
+        #{special_flags} \
+        #{configure_flags}"
+    ]
+  end
+
+  #########
+  # INSTALL
+  #########
+
+  if platform.is_windows?
+    # Ruby 3.2 copies bin/gem to $ruby_bindir/gem.cmd, but generates bat files for
+    # other gems like bundle.bat, irb.bat, etc. Just rename the cmd.cmd to cmd.bat
+    # as we used to in ruby 2.7 and earlier.
+    #
+    # Note that this step must happen after the install step above.
+    pkg.install do
+      %w[gem].map do |name|
+        "mv #{ruby_bindir}/#{name}.cmd #{ruby_bindir}/#{name}.bat"
+      end
+    end
+
+    # Required when using `stack-protection-strong` and older versions of mingw-w64-gcc
+    pkg.install_file File.join(settings[:gcc_bindir], 'libssp-0.dll'), File.join(settings[:bindir], 'libssp-0.dll')
+  end
+
+  target_doubles = {
+    'aarch64-redhat-linux' => 'aarch64-linux',
+    'arm-linux-gnueabihf' => 'arm-linux-eabihf',
+    'arm-linux-gnueabi' => 'arm-linux-eabi',
+    'x86_64-w64-mingw32' => 'x64-mingw32'
+  }
+  rbconfig_topdir = if target_doubles.key?(settings[:platform_triple])
+                      File.join(ruby_dir, 'lib', 'ruby', '4.0.0', target_doubles[settings[:platform_triple]])
+                    else
+                      "$$(#{ruby_bindir}/ruby -e \"puts RbConfig::CONFIG[\\\"topdir\\\"]\")"
+                    end
+
+  # When cross compiling or building on non-linux, we sometimes need to patch
+  # the rbconfig.rb in the "host" ruby so that later when we try to build gems
+  # with native extensions, like ffi, the "host" ruby's mkmf will use the CC,
+  # etc specified below. For example, if we're building on mac Intel for ARM,
+  # then the CC override allows us to build ffi_c.so for ARM as well. The
+  # "host" ruby is configured in _shared-agent-settings
+  rbconfig_changes = {}
+  if platform.is_macos?
+    rbconfig_changes['CC'] = "#{settings[:cc]} #{cflags}"
+  elsif platform.is_windows?
+    rbconfig_changes['CC'] = 'x86_64-w64-mingw32-gcc'
+  end
+
+  pkg.add_source('file://resources/files/ruby_vendor_gems/operating_system.rb')
+  defaults_dir = File.join(settings[:libdir], 'ruby/4.0.0/rubygems/defaults')
+  pkg.directory(defaults_dir)
+  pkg.install_file '../operating_system.rb', File.join(defaults_dir, 'operating_system.rb')
+
+  if rbconfig_changes.any?
+    pkg.install do
+      [
+        "#{host_ruby} ../rbconfig-update.rb \"#{rbconfig_changes.to_s.gsub('"', '\"')}\" #{rbconfig_topdir}",
+        "cp original_rbconfig.rb #{settings[:datadir]}/doc/rbconfig-#{pkg.get_version}-orig.rb",
+        "cp new_rbconfig.rb #{rbconfig_topdir}/rbconfig.rb"
+      ]
+    end
+  end
+end
diff --git a/configs/components/ruby-shadow-patched.json b/configs/components/ruby-shadow-patched.json
new file mode 100644
index 00000000..cbf73ccb
--- /dev/null
+++ b/configs/components/ruby-shadow-patched.json
@@ -0,0 +1,4 @@
+{
+  "url": "https://github.com/voxpupuli/ruby-shadow",
+  "ref": "bc7752a9ddbde06c1418734d003a9607bafcc6df"
+}
diff --git a/configs/components/ruby-shadow-patched.rb b/configs/components/ruby-shadow-patched.rb
new file mode 100644
index 00000000..7a7252a4
--- /dev/null
+++ b/configs/components/ruby-shadow-patched.rb
@@ -0,0 +1,34 @@
+#####
+# Component release information:
+#   https://github.com/apalmblad/ruby-shadow/tags
+#   https://rubygems.org/gems/ruby-shadow
+#   contains https://github.com/apalmblad/ruby-shadow/pull/29
+#   We are building https://github.com/voxpupuli/ruby-shadow/compare/patch-extconf
+#     * contains https://github.com/apalmblad/ruby-shadow/pull/29
+#     * diff https://github.com/apalmblad/ruby-shadow/compare/master...bastelfreak:ruby-shadow:patch-extconf
+#####
+component 'ruby-shadow-patched' do |pkg, settings, platform|
+  pkg.load_from_json('configs/components/ruby-shadow-patched.json')
+
+  pkg.build_requires "ruby-#{settings[:ruby_version]}"
+
+  pkg.environment 'CONFIGURE_ARGS', '--vendor'
+
+  if platform.is_cross_compiled?
+    pkg.environment 'RUBY', settings[:host_ruby]
+    ruby = "#{settings[:host_ruby]} -r#{settings[:datadir]}/doc/rbconfig-#{settings[:ruby_version]}-orig.rb"
+  else
+    ruby = File.join(settings[:ruby_bindir], 'ruby')
+  end
+
+  pkg.build do
+    [
+      "#{ruby} extconf.rb",
+      "#{platform[:make]} -e -j$(shell expr $(shell #{platform[:num_cores]}) + 1)"
+    ]
+  end
+
+  pkg.install do
+    ["#{platform[:make]} -e -j$(shell expr $(shell #{platform[:num_cores]}) + 1) DESTDIR=/ install"]
+  end
+end
diff --git a/configs/components/rubygem-CFPropertyList.rb b/configs/components/rubygem-CFPropertyList.rb
index b59f6474..718d4bc0 100644
--- a/configs/components/rubygem-CFPropertyList.rb
+++ b/configs/components/rubygem-CFPropertyList.rb
@@ -10,7 +10,7 @@
   ### Maintained by update_gems automation ###
   pkg.version '4.0.0'
   pkg.sha256sum '385e7bbd7c27e176b23415275ca936ca0ece1727e5b890b08e36632076b00aff'
-  pkg.build_requires 'rubygem-base64'
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   pkg.build_requires 'rubygem-rexml'
   ### End automated maintenance section ###
 
diff --git a/configs/components/rubygem-aws-sdk-core.rb b/configs/components/rubygem-aws-sdk-core.rb
index de179fa5..4f671605 100644
--- a/configs/components/rubygem-aws-sdk-core.rb
+++ b/configs/components/rubygem-aws-sdk-core.rb
@@ -10,7 +10,7 @@
   pkg.build_requires 'rubygem-aws-eventstream'
   pkg.build_requires 'rubygem-aws-partitions'
   pkg.build_requires 'rubygem-aws-sigv4'
-  pkg.build_requires 'rubygem-base64'
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   pkg.build_requires 'rubygem-jmespath'
   ### End automated maintenance section ###
 
diff --git a/configs/components/rubygem-em-socksify.rb b/configs/components/rubygem-em-socksify.rb
index 52777eb3..aa24b087 100644
--- a/configs/components/rubygem-em-socksify.rb
+++ b/configs/components/rubygem-em-socksify.rb
@@ -6,7 +6,7 @@
   ### Maintained by update_gems automation ###
   pkg.version '0.3.3'
   pkg.sha256sum '7d8d08a7a8acc1263173433a6b5540edd80a8a36e35a066b650c929a3a3974ed'
-  pkg.build_requires 'rubygem-base64'
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   pkg.build_requires 'rubygem-eventmachine'
   ### End automated maintenance section ###
 
diff --git a/configs/components/rubygem-hiera-eyaml.rb b/configs/components/rubygem-hiera-eyaml.rb
index b65f6987..08bc7e93 100644
--- a/configs/components/rubygem-hiera-eyaml.rb
+++ b/configs/components/rubygem-hiera-eyaml.rb
@@ -7,7 +7,8 @@
   ### Maintained by update_gems automation ###
   pkg.version '5.0.1'
   pkg.sha256sum 'b463fc9aa8f310659251cc7efd8c5db2e0fa893c4bc5b97e07276cb597cb93e6'
-  pkg.build_requires 'rubygem-base64'
+  # only required on Ruby 3.2. Ruby 4.0 ships a modern base64 version - https://stdgems.org/
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   pkg.build_requires 'rubygem-highline'
   pkg.build_requires 'rubygem-optimist'
   ### End automated maintenance section ###
diff --git a/configs/components/rubygem-jwt.rb b/configs/components/rubygem-jwt.rb
index c1e027c8..439bd033 100644
--- a/configs/components/rubygem-jwt.rb
+++ b/configs/components/rubygem-jwt.rb
@@ -10,7 +10,7 @@
   # PINNED
   pkg.version '2.10.2'
   pkg.sha256sum '31e1ee46f7359883d5e622446969fe9c118c3da87a0b1dca765ce269c3a0c4f4'
-  pkg.build_requires 'rubygem-base64'
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   ### End automated maintenance section ###
 
   instance_eval File.read('configs/components/_base-rubygem.rb')
diff --git a/configs/components/rubygem-openfact.rb b/configs/components/rubygem-openfact.rb
index 926cd8ad..65a30668 100644
--- a/configs/components/rubygem-openfact.rb
+++ b/configs/components/rubygem-openfact.rb
@@ -7,7 +7,7 @@
   ### Maintained by update_gems automation ###
   pkg.version '5.6.1'
   pkg.sha256sum '4cc79ea89321a1b4f44a75a86cdde496b5f140172552339011947d661f2daba9'
-  pkg.build_requires 'rubygem-base64'
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   pkg.build_requires 'rubygem-hocon'
   pkg.build_requires 'rubygem-thor'
   ### End automated maintenance section ###
diff --git a/configs/components/rubygem-openvox.rb b/configs/components/rubygem-openvox.rb
index 0534ea54..b0c94501 100644
--- a/configs/components/rubygem-openvox.rb
+++ b/configs/components/rubygem-openvox.rb
@@ -9,7 +9,7 @@
   ### Maintained by update_gems automation ###
   pkg.version '8.27.0'
   pkg.sha256sum '68c6460b036c328e79e96568b80b09d64608118e2879784326209c113ce6e835'
-  pkg.build_requires 'rubygem-base64'
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   pkg.build_requires 'rubygem-concurrent-ruby'
   pkg.build_requires 'rubygem-deep_merge'
   pkg.build_requires 'rubygem-fast_gettext'
diff --git a/configs/components/rubygem-puppet_forge.rb b/configs/components/rubygem-puppet_forge.rb
index d999869e..ef875a92 100644
--- a/configs/components/rubygem-puppet_forge.rb
+++ b/configs/components/rubygem-puppet_forge.rb
@@ -8,7 +8,7 @@
   ### Maintained by update_gems automation ###
   pkg.version '6.2.0'
   pkg.sha256sum '9cde4841a7a6950afeb0c4fec02449931179863918c0a6e6909cb2a6c6998a0c'
-  pkg.build_requires 'rubygem-base64'
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   pkg.build_requires 'rubygem-faraday'
   pkg.build_requires 'rubygem-faraday-follow_redirects'
   pkg.build_requires 'rubygem-minitar'
diff --git a/configs/components/rubygem-rubyntlm.rb b/configs/components/rubygem-rubyntlm.rb
index 3b85701c..f90e9b2f 100644
--- a/configs/components/rubygem-rubyntlm.rb
+++ b/configs/components/rubygem-rubyntlm.rb
@@ -7,7 +7,7 @@
   ### Maintained by update_gems automation ###
   pkg.version '0.6.5'
   pkg.sha256sum '47013402b99ae29ee93f930af51edaec8c6008556f4be25705a422b4430314f5'
-  pkg.build_requires 'rubygem-base64'
+  pkg.build_requires 'rubygem-base64' if settings[:ruby_version] == '3.2'
   ### End automated maintenance section ###
 
   instance_eval File.read('configs/components/_base-rubygem.rb')
diff --git a/configs/projects/_shared-agent-settings.rb b/configs/projects/_shared-agent-settings.rb
index 175721b6..e1445fc0 100644
--- a/configs/projects/_shared-agent-settings.rb
+++ b/configs/projects/_shared-agent-settings.rb
@@ -118,8 +118,6 @@
 # Load default compiler settings
 instance_eval File.read('configs/projects/_shared-compiler-settings.rb')
 
-proj.setting(:openssl_version, '3.0')
-
 if platform.is_windows?
   proj.setting(:gcc_root, '/usr/x86_64-w64-mingw32/sys-root/mingw')
   proj.setting(:gcc_bindir, "#{proj.gcc_root}/bin")
diff --git a/configs/projects/agent-runtime-8.x.rb b/configs/projects/agent-runtime-8.x.rb
index 5c5d6ac6..21018bc7 100644
--- a/configs/projects/agent-runtime-8.x.rb
+++ b/configs/projects/agent-runtime-8.x.rb
@@ -2,6 +2,7 @@
   # Set preferred component versions if they differ from defaults:
   proj.setting :ruby_version, '3.2' # Leave the .Z out for Ruby 3.2
   proj.setting :rubygem_highline_version, '3.0.1'
+  proj.setting :openssl_version, '3.0'
 
   ########
   # Load shared agent settings
diff --git a/configs/projects/agent-runtime-main.rb b/configs/projects/agent-runtime-main.rb
index 1925e8a2..ec2f622a 100644
--- a/configs/projects/agent-runtime-main.rb
+++ b/configs/projects/agent-runtime-main.rb
@@ -1,7 +1,8 @@
 project 'agent-runtime-main' do |proj|
   # Set preferred component versions if they differ from defaults:
-  proj.setting :ruby_version, '3.2' # Leave the .Z out for Ruby 3.2
-  proj.setting :rubygem_highline_version, '3.0.1'
+  proj.setting :ruby_version, '4.0' # Leave the .Z out
+  proj.setting :rubygem_highline_version, '3.1.2'
+  proj.setting :openssl_version, '3.5'
 
   ########
   # Load shared agent settings
@@ -35,11 +36,9 @@
   proj.component 'libyaml'
   proj.component "openssl-#{proj.openssl_version}"
 
-  proj.component 'curl'
   proj.component 'puppet-ca-bundle'
   proj.component "ruby-#{proj.ruby_version}"
 
-  proj.component 'rubygem-base64'
   proj.component 'rubygem-concurrent-ruby'
   proj.component 'rubygem-deep_merge'
   proj.component 'rubygem-erubi'
@@ -50,7 +49,6 @@
   proj.component 'rubygem-highline'
   proj.component 'rubygem-hocon'
   proj.component 'rubygem-locale'
-  proj.component 'rubygem-multi_json' # TODO: obsolete for openvox 9 - https://github.com/OpenVoxProject/openvox/pull/293
   proj.component 'rubygem-net-ssh'
   proj.component 'rubygem-optimist'
   proj.component 'rubygem-semantic_puppet'
@@ -75,7 +73,7 @@
   end
 
   unless platform.is_windows?
-    proj.component 'ruby-shadow'
+    proj.component 'ruby-shadow-patched'
   end
 
   # We only build ruby-selinux for EL, Fedora, Debian and Ubuntu (amd64/i386)
diff --git a/configs/projects/openbolt-runtime.rb b/configs/projects/openbolt-runtime.rb
index 99475bc5..549b8f64 100644
--- a/configs/projects/openbolt-runtime.rb
+++ b/configs/projects/openbolt-runtime.rb
@@ -175,6 +175,7 @@
   proj.component 'rubygem-bindata'
   proj.component 'rubygem-builder'
   proj.component 'rubygem-CFPropertyList'
+  # needs to come before hiera-eyaml. Otherwise vanagon tries to install a deb/rpm called rubygem-base64
   proj.component 'rubygem-base64'
   proj.component 'rubygem-rexml'
   proj.component 'rubygem-colored2'