diff --git a/Gemfile b/Gemfile
index 1f0a76d177..19596d70fe 100644
--- a/Gemfile
+++ b/Gemfile
@@ -20,9 +20,9 @@ gem "devise", "~> 4.9"
 gem "dfe-analytics", github: "slawosz/dfe-analytics", branch: "allow-to-exclude-models"
 
 gem "email_validator", require: "email_validator/strict"
-gem "flipper", "~> 1.2.2"
-gem "flipper-active_record", "~> 1.2.2"
-gem "flipper-ui", "~> 1.2.2"
+gem "flipper", "~> 1.3"
+gem "flipper-active_record", "~> 1.3"
+gem "flipper-ui", "~> 1.3"
 gem "google-cloud-bigquery"
 gem "govuk-components", "~> 5.7.1"
 gem "govuk_design_system_formbuilder", "~> 5.4.0"
diff --git a/Gemfile.lock b/Gemfile.lock
index 5ee66e0e9b..fe57907689 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -217,16 +217,17 @@ GEM
     ffi (1.17.1-x86_64-darwin)
     ffi (1.17.1-x86_64-linux-gnu)
     ffi (1.17.1-x86_64-linux-musl)
-    flipper (1.2.2)
+    flipper (1.3.2)
       concurrent-ruby (< 2)
-    flipper-active_record (1.2.2)
-      activerecord (>= 4.2, < 8)
-      flipper (~> 1.2.2)
-    flipper-ui (1.2.2)
+    flipper-active_record (1.3.2)
+      activerecord (>= 4.2, < 9)
+      flipper (~> 1.3.2)
+    flipper-ui (1.3.2)
       erubi (>= 1.0.0, < 2.0.0)
-      flipper (~> 1.2.2)
+      flipper (~> 1.3.2)
       rack (>= 1.4, < 4)
-      rack-protection (>= 1.5.3, <= 4.0.0)
+      rack-protection (>= 1.5.3, < 5.0.0)
+      rack-session (>= 1.0.2, < 3.0.0)
       sanitize (< 7)
     fugit (1.11.1)
       et-orbi (~> 1, >= 1.2.11)
@@ -421,18 +422,20 @@ GEM
       nio4r (~> 2.0)
     raabro (1.4.0)
     racc (1.8.1)
-    rack (2.2.10)
+    rack (3.1.8)
     rack-attack (6.7.0)
       rack (>= 1.0, < 4)
-    rack-protection (3.1.0)
-      rack (~> 2.2, >= 2.2.4)
-    rack-session (1.0.2)
-      rack (< 3)
+    rack-protection (4.1.1)
+      base64 (>= 0.1.0)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.0)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
     rack-test (2.2.0)
       rack (>= 1.3)
-    rackup (1.0.1)
-      rack (< 3)
-      webrick
+    rackup (2.2.1)
+      rack (>= 3)
     rails (7.1.5.1)
       actioncable (= 7.1.5.1)
       actionmailbox (= 7.1.5.1)
@@ -610,10 +613,12 @@ GEM
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.13.1)
     simplecov_json_formatter (0.1.4)
-    sinatra (3.1.0)
+    sinatra (4.1.1)
+      logger (>= 1.6.0)
       mustermann (~> 3.0)
-      rack (~> 2.2, >= 2.2.4)
-      rack-protection (= 3.1.0)
+      rack (>= 3.0.0, < 4)
+      rack-protection (= 4.1.1)
+      rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
     site_prism (5.0.4)
       addressable (~> 2.8, >= 2.8.4)
@@ -674,7 +679,6 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.9.1)
     websocket (1.2.11)
     websocket-driver (0.7.7)
       base64
@@ -717,9 +721,9 @@ DEPENDENCIES
   email_validator
   factory_bot_rails
   faker (~> 3.5)
-  flipper (~> 1.2.2)
-  flipper-active_record (~> 1.2.2)
-  flipper-ui (~> 1.2.2)
+  flipper (~> 1.3)
+  flipper-active_record (~> 1.3)
+  flipper-ui (~> 1.3)
   google-cloud-bigquery
   govuk-components (~> 5.7.1)
   govuk_design_system_formbuilder (~> 5.4.0)