diff --git a/Gemfile b/Gemfile
index cd2fb4551f1..2fd2d24e11c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -67,7 +67,7 @@ gem 'redacted_struct'
 gem 'redis', '>= 3.2.0'
 gem 'redis-session-store', github: '18F/redis-session-store', tag: 'v1.0.1-18f'
 gem 'retries'
-gem 'rexml', '~> 3.3'
+gem 'rexml', '~> 3.3', '>= 3.3.3'
 gem 'rotp', '~> 6.3', '>= 6.3.0'
 gem 'rqrcode'
 gem 'ruby-progressbar'
diff --git a/Gemfile.lock b/Gemfile.lock
index 28d3d42dd70..65b185ac5f1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -838,7 +838,7 @@ DEPENDENCIES
   redis (>= 3.2.0)
   redis-session-store!
   retries
-  rexml (~> 3.3)
+  rexml (~> 3.3, >= 3.3.3)
   rotp (~> 6.3, >= 6.3.0)
   rqrcode
   rspec (~> 3.13.0)
@@ -876,7 +876,7 @@ DEPENDENCIES
   zxcvbn (= 0.1.9)
 
 RUBY VERSION
-   ruby 3.3.1p55
+   ruby 2.7.8p225
 
 BUNDLED WITH
    2.5.6