diff --git a/Gemfile b/Gemfile
index 3b117bb..35bd6cc 100644
--- a/Gemfile
+++ b/Gemfile
@@ -40,7 +40,10 @@ gem "sass-rails", "~> 6.0"
 gem "terser"
 
 gem "redcarpet"
-gem "wicked_pdf", "1.4.0"
+gem "wicked_pdf", "~> 2.8"
+# wkhtmltopdf-binary is held at 0.12.3.1: the 0.12.6.x Linux binary segfaults
+# (SIGSEGV) in CI/Heroku, and 0.12.6 also blocks local file access by default,
+# which breaks the PDF's logo/stylesheet. wkhtmltopdf is EOL, so 0.12.3.1 stays.
 gem "wkhtmltopdf-binary", "0.12.3.1"
 
 gem "fastruby-styleguide", git: "https://github.com/fastruby/styleguide.git", branch: "gh-pages"
diff --git a/Gemfile.lock b/Gemfile.lock
index 920bfb8..cd16845 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -407,8 +407,9 @@ GEM
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
-    wicked_pdf (1.4.0)
+    wicked_pdf (2.8.2)
       activesupport
+      ostruct
     wkhtmltopdf-binary (0.12.3.1)
     xpath (3.2.0)
       nokogiri (~> 1.8)
@@ -443,7 +444,7 @@ DEPENDENCIES
   terser
   tzinfo-data
   web-console (>= 3.3.0)
-  wicked_pdf (= 1.4.0)
+  wicked_pdf (~> 2.8)
   wkhtmltopdf-binary (= 0.12.3.1)
 
 RUBY VERSION
diff --git a/Gemfile.next.lock b/Gemfile.next.lock
index 920bfb8..cd16845 100644
--- a/Gemfile.next.lock
+++ b/Gemfile.next.lock
@@ -407,8 +407,9 @@ GEM
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
-    wicked_pdf (1.4.0)
+    wicked_pdf (2.8.2)
       activesupport
+      ostruct
     wkhtmltopdf-binary (0.12.3.1)
     xpath (3.2.0)
       nokogiri (~> 1.8)
@@ -443,7 +444,7 @@ DEPENDENCIES
   terser
   tzinfo-data
   web-console (>= 3.3.0)
-  wicked_pdf (= 1.4.0)
+  wicked_pdf (~> 2.8)
   wkhtmltopdf-binary (= 0.12.3.1)
 
 RUBY VERSION