diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 521af05..4380a00 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -15,7 +15,7 @@ jobs:
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
-        ruby-version: 3.3
+        ruby-version: 3.4
     - name: Install dependencies
       run: bundle install
     - name: Run RuboCop against BASE..HEAD changes
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ab6dc19..0c0cee0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,11 +5,13 @@ on: [push]
 jobs:
   test:
     strategy:
+      fail-fast: false
       matrix:
         ruby-version:
           - '3.1'
           - '3.2'
           - '3.3'
+          - '3.4'
         gemfile:
           - gemfiles/Gemfile.rails70
           - gemfiles/Gemfile.rails71
@@ -20,6 +22,10 @@ jobs:
           # https://www.fastruby.io/blog/ruby/rails/versions/compatibility-table.html
           - ruby-version: '3.1'
             gemfile: 'gemfiles/Gemfile.rails80'
+          # rails 7.0 requires ruby <= 3.3
+          # https://www.fastruby.io/blog/ruby/rails/versions/compatibility-table.html
+          - ruby-version: '3.4'
+            gemfile: 'gemfiles/Gemfile.rails70'
 
     name: Ruby ${{ matrix.ruby-version }} / Bundle ${{ matrix.gemfile }}
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a20014e..77129a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 ## [Unreleased]
-*no unreleased changes*
+### Fixed
+* Capistrano: deploy:preinstall should fix up installed gem permissions
+* Support Ruby 3.4
+
+### Added
+* Capistrano: cleanup bundled gems for old ruby versions.
 
 ## 7.3.3 / 2025-07-31
 ### Fixed
diff --git a/lib/ndr_dev_support/capistrano/install_ruby.rb b/lib/ndr_dev_support/capistrano/install_ruby.rb
index 87ab17b..c7f6abb 100644
--- a/lib/ndr_dev_support/capistrano/install_ruby.rb
+++ b/lib/ndr_dev_support/capistrano/install_ruby.rb
@@ -97,7 +97,29 @@
         fi
       SHELL
     end
+
+    desc <<~DESC
+      Cleanup bundled gems for old ruby versions.
+
+      Deletes shared bundle files that no longer match any installed releases.
+
+      This interacts reasonably with deploy:preinstall:
+      When deploy:preinstall installs new .rbenv and new shared bundled gems, this
+      will not delete them. If an older ruby version is then deployed, this removes
+      the new version's installed bundle, but leaves the .rbenv installation.
+    DESC
+    task :cleanup_unused_bundles do
+      # For ruby X.Y.Z, bundled gems are in .../shared/bundle/ruby/X.Y.0
+      # Generates e.g.
+      # find_options="-not ( -name DUMMY -or -name 3.1.0 -or -name 3.2.0 )"
+      # and then removes e.g. shared/bundle/ruby/3.0.0
+      run "find_options=\"-not ( -name DUMMY `grep -ho '^[0-9]*[.][0-9]*' " \
+          "#{releases_path}/*/.ruby-version | sed -e 's/.*/-or -name &.0/'` ) \"; " \
+          "find #{File.join(shared_path, 'bundle/ruby/*')} -maxdepth 0 $find_options " \
+          "-exec echo rm -rf '{}' ';' -exec rm -rf '{}' ';'"
+    end
   end
 
   before 'bundle:install', 'ndr_dev_support:install_ruby'
+  after 'deploy:finalize_update', 'ndr_dev_support:cleanup_unused_bundles'
 end
diff --git a/lib/ndr_dev_support/capistrano/ndr_model.rb b/lib/ndr_dev_support/capistrano/ndr_model.rb
index b229a01..41a642c 100644
--- a/lib/ndr_dev_support/capistrano/ndr_model.rb
+++ b/lib/ndr_dev_support/capistrano/ndr_model.rb
@@ -164,8 +164,12 @@
         # already there:
         run "rm -rf #{File.join(release_path, path)} && ln -s #{File.join(shared_path, path)} #{File.join(release_path, path)}"
       end
+    end
+
+    after 'deploy:finalize_update', 'ndr_dev_support:filesystem_tweaks'
 
-      # Make the shared/bundle/ directory writeable by deployers:
+    desc 'Make the shared/bundle/ directory writeable by deployers'
+    task :bundle_permissions do
       # We already set group permissions correctly in the bundle directory, but some gem installs
       # ignore these permissions, so we need to fix them up.
       # Set deployer group for everything created by this user
@@ -178,7 +182,8 @@
           '-not -perm -0064 -print0 |xargs -r0 chmod g+rw,o+r'
     end
 
-    after 'deploy:finalize_update', 'ndr_dev_support:filesystem_tweaks'
+    # Ensure we have fixed the bundle permissions before potentially aborting
+    before 'ndr_dev_support:check_preinstall', 'ndr_dev_support:bundle_permissions'
   end
 end