diff --git a/Gemfile b/Gemfile
index 6b538e9d86..4bc90e135a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -47,7 +47,7 @@ gem 'open_id_authentication'
 gem 'i18n'
 
 # Apisonator client
-gem 'pisoni', '~> 1.30'
+gem 'pisoni', '~> 1.31'
 
 gem '3scale_time_range', '0.0.6'
 
@@ -76,14 +76,26 @@ gem 'htmlentities', '~>4.3', '>= 4.3.4'
 # TODO: Not actively maintained https://github.com/activeadmin/inherited_resources#notice replace with respond_with and fix things the rails way
 gem 'inherited_resources', '~> 1.12.0'
 gem 'json', '~> 2.7', '>= 2.7.1'
+# uri >= 1.0.0 switched the default parser from RFC2396 to RFC3986 (ruby/uri#107),
+# removed URI::DEFAULT_PARSER, dropped URI.decode, and the RFC3986 parser has no
+# `registry` component. We rely on all of these across models (Proxy, ProxyRule,
+# WebHook, AuthenticationProvider) and controllers. Upgrading is worthwhile but
+# requires careful inspection of every call-site and should be deployed/tested
+# separately from the Faraday update.
+gem 'uri', '< 1.0.0'
 
 gem 'mysql2', '~> 0.5.3'
 
 gem '3scale_client', '~> 2.11', require: false
 gem 'analytics-ruby', require: false
 
+# connection_pool 3.0 changed `#with` from positional to keyword-only args,
+# breaking redis-client 0.22.2 (pinned by hiredis-client). Upgrading
+# hiredis-client + redis-client to >= 0.26.3 would resolve this; until then
+# keep connection_pool on 2.x.
+gem 'connection_pool', '~> 2.2', '< 3'
 gem 'dalli'
-gem 'faraday', '~> 2.0', '<= 2.9'
+gem 'faraday', '~> 2.0', '>= 2.14.3'
 gem 'mimemagic', '~> 0.3.10'
 gem 'nokogiri', '~> 1.15.5'
 gem 'secure_headers', '~> 6.3.0'
diff --git a/Gemfile.lock b/Gemfile.lock
index 433c6b52b3..c8dfb1a7d6 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -202,7 +202,6 @@ GEM
     baby_squeel (1.4.4)
       activerecord (>= 5.2, < 7.1)
       ransack (~> 2.3)
-    base64 (0.2.0)
     bcrypt (3.1.13)
     binding_of_caller (1.0.0)
       debug_inspector (>= 0.0.1)
@@ -262,7 +261,7 @@ GEM
       sass-rails (< 5.1)
       sprockets (< 4.0)
     concurrent-ruby (1.2.3)
-    connection_pool (2.4.1)
+    connection_pool (2.5.5)
     crack (0.4.5)
       rexml
     crass (1.0.6)
@@ -361,14 +360,15 @@ GEM
       factory_bot (~> 6.2.0)
       railties (>= 5.0.0)
     fakefs (1.8.0)
-    faraday (2.8.1)
-      base64
-      faraday-net_http (>= 2.0, < 3.1)
-      ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.2)
-    faraday-net_http_persistent (2.1.0)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    faraday-net_http_persistent (2.3.1)
       faraday (~> 2.5)
-      net-http-persistent (~> 4.0)
+      net-http-persistent (>= 4.0.4, < 5)
     ffi (1.15.4)
     ffi-compiler (1.0.1)
       ffi (>= 1.0.0)
@@ -420,7 +420,7 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    json (2.7.1)
+    json (2.20.0)
     jsonpath (1.1.2)
       multi_json
     jwt (1.5.6)
@@ -457,6 +457,7 @@ GEM
     local-fastimage (3.1.3)
     local-fastimage_resize (3.4.0)
       local-fastimage (~> 3.0)
+    logger (1.7.0)
     loofah (2.22.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
@@ -503,9 +504,11 @@ GEM
     mustache (1.1.1)
     mysql2 (0.5.3)
     n_plus_one_control (0.6.2)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
     net-http-digest_auth (1.4.1)
-    net-http-persistent (4.0.2)
-      connection_pool (~> 2.2)
+    net-http-persistent (4.0.8)
+      connection_pool (>= 2.2.4, < 4)
     netrc (0.11.0)
     nio4r (2.5.9)
     nokogiri (1.15.6)
@@ -538,8 +541,8 @@ GEM
       ruby-rc4
       ttfunk
     pg (0.21.0)
-    pisoni (1.30.0)
-      faraday (~> 2.0, <= 2.9)
+    pisoni (1.31.0)
+      faraday (~> 2.0, >= 2.14.3)
       faraday-net_http_persistent (~> 2.1)
       injectedlogger (= 0.0.13)
       json (~> 2.7, >= 2.7.1)
@@ -883,6 +886,7 @@ GEM
       rack
       unicorn
     uniform_notifier (1.14.2)
+    uri (0.13.3)
     version_gem (1.1.3)
     webmock (3.8.3)
       addressable (>= 2.3.6)
@@ -959,6 +963,7 @@ DEPENDENCIES
   colorize
   commonmarker (~> 0.23.10)
   compass-rails (~> 3.0.2)
+  connection_pool (~> 2.2, < 3)
   cucumber (~> 7.0)
   cucumber-rails (~> 2.4.0)
   dalli
@@ -973,7 +978,7 @@ DEPENDENCIES
   escape_utils
   factory_bot_rails (~> 6.2)
   fakefs
-  faraday (~> 2.0, <= 2.9)
+  faraday (~> 2.0, >= 2.14.3)
   font-awesome-rails (~> 4.7.0.5)
   formtastic (~> 4.0)
   github-markdown
@@ -1012,7 +1017,7 @@ DEPENDENCIES
   open_id_authentication
   pdf-inspector
   pg (~> 0.21.0)
-  pisoni (~> 1.30)
+  pisoni (~> 1.31)
   prawn
   prawn-svg
   prawn-table!
@@ -1079,6 +1084,7 @@ DEPENDENCIES
   uglifier
   unicorn
   unicorn-rails
+  uri (< 1.0.0)
   webmock (~> 3.8.0)
   webpacker (= 5.4.4)
   will_paginate (~> 3.3)