diff --git a/CHANGELOG.md b/CHANGELOG.md
index fed85de..5efd83a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 ## [Unreleased]
-*no unreleased changes*
+### Fixed
+* Capistrano: Add missing `tmpdir` requirement to deploy application secrets
 
 ## 7.3.1 / 2025-01-02
 ### Added
diff --git a/gemfiles/Gemfile.rails61 b/gemfiles/Gemfile.rails61
index 02017be..6083b3b 100644
--- a/gemfiles/Gemfile.rails61
+++ b/gemfiles/Gemfile.rails61
@@ -2,3 +2,6 @@ source 'https://rubygems.org'
 gemspec path: '..'
 
 gem 'activesupport', '~> 6.1.0'
+
+# Latest concurrent-ruby breaks Rails < 7.1. See https://github.com/rails/rails/issues/54260
+gem 'concurrent-ruby', '1.3.4'
diff --git a/gemfiles/Gemfile.rails70 b/gemfiles/Gemfile.rails70
index d6175dd..8eec5b8 100644
--- a/gemfiles/Gemfile.rails70
+++ b/gemfiles/Gemfile.rails70
@@ -2,3 +2,6 @@ source 'https://rubygems.org'
 gemspec path: '..'
 
 gem 'activesupport', '~> 7.0.0'
+
+# Latest concurrent-ruby breaks Rails < 7.1. See https://github.com/rails/rails/issues/54260
+gem 'concurrent-ruby', '1.3.4'
diff --git a/lib/ndr_dev_support/capistrano/deploy_secrets.rb b/lib/ndr_dev_support/capistrano/deploy_secrets.rb
index 4465920..b2d2f9f 100644
--- a/lib/ndr_dev_support/capistrano/deploy_secrets.rb
+++ b/lib/ndr_dev_support/capistrano/deploy_secrets.rb
@@ -1,3 +1,5 @@
+require 'tmpdir'
+
 # Add a git or svn secrets respository for ndr_dev_support:deploy_secrets
 def add_secrets_repo(name:, url:, scm:, branch: nil)
   raise "Invalid repo name #{name}" unless /\A[A-Z0-9_-]+\z/i.match?(name)