diff --git a/.dockerignore b/.dockerignore
index bb195e83d..b3b6fcc4c 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -12,7 +12,6 @@
 !/log/.keep
 !/public
 !/tmp/.keep
-!/vendor/.keep
 
 # allow files @ app root
 !config.ru
diff --git a/Dockerfile b/Dockerfile
index 0adb1b5ae..b36dee401 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,23 +30,23 @@ ENV HYRAX_CACHE_PATH=/spot/tmp/cache \
     HYRAX_UPLOAD_PATH=/spot/tmp/uploads \
     BUNDLE_FORCE_RUBY_PLATFORM=1
 
-# @todo upgrade the Gemfile bundler version to 2 to remove version constraint
+RUN corepack enable
 
 COPY ["Gemfile", "Gemfile.lock", "/spot/"]
 RUN gem install bundler:$(tail -n 1 Gemfile.lock | sed -e 's/\s*//')
-RUN bundle config unset with && \
+RUN bundle config set deployment true && \
+    bundle config unset with && \
     bundle config unset without && \
     bundle config set without "development:test" && \
     bundle install --jobs "$(nproc)"
 
-ENTRYPOINT ["/spot/bin/spot-entrypoint.sh"]
-CMD ["bundle", "exec", "rails", "server", "-b", "ssl://0.0.0.0:443?key=/spot/tmp/ssl/application.key&cert=/spot/tmp/ssl/application.crt"]
-
 ARG build_date=""
 ENV SPOT_BUILD_DATE="$build_date"
 
-HEALTHCHECK CMD curl -skf https://localhost/healthcheck/default || exit 1
+ENTRYPOINT ["/spot/bin/spot-entrypoint.sh"]
+CMD ["bundle", "exec", "rails", "server", "-b", "ssl://0.0.0.0:443?key=/spot/tmp/ssl/application.key&cert=/spot/tmp/ssl/application.crt"]
 
+HEALTHCHECK CMD curl -skf https://localhost/healthcheck/default || exit 1
 
 ##
 #  Target: spot-asset-builder
@@ -56,8 +56,7 @@ FROM spot-base as spot-asset-builder
 ENV RAILS_ENV=production
 COPY . /spot
 
-RUN corepack enable && \
-    SECRET_KEY_BASE="$(bin/rake secret)" FEDORA_URL="http://fakehost:8080/rest" bundle exec rake assets:precompile
+RUN SECRET_KEY_BASE="$(bin/rake secret)" FEDORA_URL="http://fakehost:8080/rest" bundle exec rake assets:precompile
 
 ##
 # TARGET: spot-web
diff --git a/Gemfile b/Gemfile
index e7d800957..081fd06d5 100644
--- a/Gemfile
+++ b/Gemfile
@@ -137,6 +137,8 @@ gem 'sprockets-es6', '~> 0.9.2'
 # @todo remove when Hyrax 3.5.1 or 3.6 (whichever includes it) drops
 gem 'redlock', '>= 0.1.2', '< 2.0'
 
+gem 'nokogiri', '< 1.16.0'
+
 # development dependencies (not as necessary to
 # lock down versions here)
 group :development do
diff --git a/Gemfile.lock b/Gemfile.lock
index bce4a68af..158100317 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -107,7 +107,6 @@ GEM
       validatable (~> 1.6)
     bcp47 (0.3.3)
       i18n
-    bcp47_spec (0.2.1)
     bcrypt (3.1.19)
     bibtex-ruby (6.0.0)
       latex-decode (~> 0.0)
@@ -640,7 +639,7 @@ GEM
     noid-rails (3.0.3)
       actionpack (>= 5.0.0, < 7)
       noid (~> 0.9)
-    nokogiri (1.16.0)
+    nokogiri (1.15.5)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     non-digest-assets (2.2.0)
@@ -679,14 +678,14 @@ GEM
     public_suffix (5.0.3)
     puma (6.4.0)
       nio4r (~> 2.0)
-    qa (5.10.0)
+    qa (5.11.0)
       activerecord-import
       deprecation
       faraday (< 3.0, != 2.0.0)
       geocoder
       ldpath
       nokogiri (~> 1.6)
-      rails (>= 5.0, < 7.1)
+      rails (>= 5.0, < 7.2)
       rdf
     raabro (1.4.0)
     racc (1.7.3)
@@ -738,8 +737,7 @@ GEM
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rdf (3.3.1)
-      bcp47_spec (~> 0.2)
+    rdf (3.2.11)
       link_header (~> 0.0, >= 0.0.8)
     rdf-aggregate-repo (3.2.1)
       rdf (~> 3.2)
@@ -769,11 +767,10 @@ GEM
       rdf-aggregate-repo (~> 3.2)
       rdf-vocab (~> 3.2)
       rdf-xsd (~> 3.2)
-    rdf-rdfxml (3.2.1)
-      haml (~> 5.2)
+    rdf-rdfxml (3.2.2)
+      builder (~> 3.2)
       htmlentities (~> 4.3)
       rdf (~> 3.2)
-      rdf-rdfa (~> 3.2)
       rdf-xsd (~> 3.2)
     rdf-reasoner (0.8.0)
       rdf (~> 3.2)
@@ -901,7 +898,7 @@ GEM
       ffi (~> 1.9)
     scanf (1.0.0)
     select2-rails (3.5.11)
-    selenium-webdriver (4.10.0)
+    selenium-webdriver (4.9.0)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
@@ -1090,6 +1087,7 @@ DEPENDENCIES
   linkeddata (~> 3.1.6)
   listen (>= 3.0.5, < 3.8)
   mini_magick (~> 4.11)
+  nokogiri (< 1.16.0)
   non-digest-assets (~> 2.2.0)
   okcomputer (~> 1.18.5)
   pg (~> 1.5.4)
@@ -1120,4 +1118,4 @@ DEPENDENCIES
   webmock (~> 3.19)
 
 BUNDLED WITH
-   2.4.7
+   2.4.19