diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index baa6c0578..69ce76889 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -169,15 +169,25 @@ jobs:
       - run: ruby -v
 
   testLatestRubygemsVersion:
-    name: "Test rubygems: latest upgrades the default RubyGems version"
+    name: "Ruby ${{ matrix.ruby }}: latest upgrades RubyGems"
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - { ruby: '3.2', expected_rubygems_version: '3.5.3'  }
+        - { ruby: '3.0', expected_rubygems_version: '3.5.3'  }
+        - { ruby: '2.7', expected_rubygems_version: '3.4.22' }
+        - { ruby: '2.6', expected_rubygems_version: '3.4.22' }
+        - { ruby: '2.5', expected_rubygems_version: '3.3.27' }
+        - { ruby: '2.3', expected_rubygems_version: '3.3.27' }
     steps:
     - uses: actions/checkout@v4
     - uses: ./
       with:
-        ruby-version: '2.6'
+        ruby-version: ${{ matrix.ruby }}
         rubygems: latest
-    - run: ruby -e "exit(Gem.rubygems_version > Gem::Version.new('3.0.3'))"
+    - run: ruby -e 'puts Gem::VERSION; exit(Gem.rubygems_version >= Gem::Version.new("${{ matrix.expected_rubygems_version }}"))'
 
   testFixedRubygemsVersionUpgrades:
     name: "Test rubygems: version upgrades RubyGems to that version if the default is older"
diff --git a/action.yml b/action.yml
index c36fafdb2..45c508b2d 100644
--- a/action.yml
+++ b/action.yml
@@ -12,7 +12,8 @@ inputs:
     description: |
       The version of RubyGems to use. Either 'default' (the default), 'latest', or a version number (e.g., 3.3.5).
       For 'default', no action is taken and the version of RubyGems that comes with Ruby by default is used.
-      For 'latest', `gem update --system` is run to update to the latest RubyGems version.
+      For 'latest', `gem update --system` is run to update to the latest compatible RubyGems version.
+      Ruby head/master builds and Ruby 2.2 and earlier will not be updated.
       Similarly, if a version number is given, `gem update --system <version>` is run to update to that version of RubyGems, as long as that version is newer than the one provided by default.
   bundler:
     description: |
diff --git a/dist/index.js b/dist/index.js
index 599f4bce9..8d7387324 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -65086,11 +65086,12 @@ __nccwpck_require__.r(__webpack_exports__);
 /* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
 /* harmony export */   "rubygemsUpdate": () => (/* binding */ rubygemsUpdate)
 /* harmony export */ });
+const common = __nccwpck_require__(3143)
 const path = __nccwpck_require__(1017)
 const exec = __nccwpck_require__(1514)
 const semver = __nccwpck_require__(1383)
 
-async function rubygemsUpdate(rubygemsVersionInput, rubyPrefix) {
+async function rubygemsUpdate(rubygemsVersionInput, rubyPrefix, platform, engine, version) {
   const gem = path.join(rubyPrefix, 'bin', 'gem')
 
   let gemVersion = ''
@@ -65106,7 +65107,7 @@ async function rubygemsUpdate(rubygemsVersionInput, rubyPrefix) {
 
   if (rubygemsVersionInput === 'latest') {
     console.log('Updating RubyGems to latest version')
-    await exec.exec(gem, ['update', '--system'])
+    await rubygemsLatest(gem, platform, engine, version)
   } else if (semver.gt(rubygemsVersionInput, gemVersion)) {
     console.log(`Updating RubyGems to ${rubygemsVersionInput}`)
     await exec.exec(gem, ['update', '--system', rubygemsVersionInput])
@@ -65117,6 +65118,30 @@ async function rubygemsUpdate(rubygemsVersionInput, rubyPrefix) {
   return true
 }
 
+// Older RubyGems versions do not account for 'required_ruby_version' when
+// running 'gem update --system', so we have to force a compatible version of
+// rubygems-update.  See https://github.com/ruby/setup-ruby/pull/551 and
+// https://github.com/rubygems/rubygems/issues/7329
+async function rubygemsLatest(gem, platform, engine, version) {
+  if (engine === 'ruby') {
+    const rubyFloatVersion = common.floatVersion(version)
+    if (common.isHeadVersion(version)) {
+      console.log('Ruby master builds use included RubyGems')
+    } else if (rubyFloatVersion >= 3.0) {
+      await exec.exec(gem, ['update', '--system'])
+    } else if (rubyFloatVersion >= 2.6) {
+      await exec.exec(gem, ['update', '--system', '3.4.22'])
+    } else if (rubyFloatVersion >= 2.3) {
+      await exec.exec(gem, ['update', '--system', '3.3.27'])
+    } else {
+      console.log(`Cannot update RubyGems for Ruby version ${version}`)
+    }
+  } else {
+    // non MRI Rubies (TruffleRuby and JRuby)
+    await exec.exec(gem, ['update', '--system'])
+  }
+}
+
 
 /***/ }),
 
@@ -65775,7 +65800,7 @@ async function setupRuby(options = {}) {
   const rubygemsInputSet = inputs['rubygems'] !== 'default'
   if (rubygemsInputSet) {
     await common.measure('Updating RubyGems', async () =>
-      rubygems.rubygemsUpdate(inputs['rubygems'], rubyPrefix))
+      rubygems.rubygemsUpdate(inputs['rubygems'], rubyPrefix, platform, engine, version))
   }
 
   // When setup-ruby is used by other actions, this allows code in them to run
diff --git a/index.js b/index.js
index a9735b567..9e393de04 100644
--- a/index.js
+++ b/index.js
@@ -78,7 +78,7 @@ export async function setupRuby(options = {}) {
   const rubygemsInputSet = inputs['rubygems'] !== 'default'
   if (rubygemsInputSet) {
     await common.measure('Updating RubyGems', async () =>
-      rubygems.rubygemsUpdate(inputs['rubygems'], rubyPrefix))
+      rubygems.rubygemsUpdate(inputs['rubygems'], rubyPrefix, platform, engine, version))
   }
 
   // When setup-ruby is used by other actions, this allows code in them to run
diff --git a/rubygems.js b/rubygems.js
index 8b77bd7f3..6d41e248a 100644
--- a/rubygems.js
+++ b/rubygems.js
@@ -1,8 +1,9 @@
+const common = require('./common')
 const path = require('path')
 const exec = require('@actions/exec')
 const semver = require('semver')
 
-export async function rubygemsUpdate(rubygemsVersionInput, rubyPrefix) {
+export async function rubygemsUpdate(rubygemsVersionInput, rubyPrefix, platform, engine, version) {
   const gem = path.join(rubyPrefix, 'bin', 'gem')
 
   let gemVersion = ''
@@ -18,7 +19,7 @@ export async function rubygemsUpdate(rubygemsVersionInput, rubyPrefix) {
 
   if (rubygemsVersionInput === 'latest') {
     console.log('Updating RubyGems to latest version')
-    await exec.exec(gem, ['update', '--system'])
+    await rubygemsLatest(gem, platform, engine, version)
   } else if (semver.gt(rubygemsVersionInput, gemVersion)) {
     console.log(`Updating RubyGems to ${rubygemsVersionInput}`)
     await exec.exec(gem, ['update', '--system', rubygemsVersionInput])
@@ -28,3 +29,27 @@ export async function rubygemsUpdate(rubygemsVersionInput, rubyPrefix) {
 
   return true
 }
+
+// Older RubyGems versions do not account for 'required_ruby_version' when
+// running 'gem update --system', so we have to force a compatible version of
+// rubygems-update.  See https://github.com/ruby/setup-ruby/pull/551 and
+// https://github.com/rubygems/rubygems/issues/7329
+async function rubygemsLatest(gem, platform, engine, version) {
+  if (engine === 'ruby') {
+    const rubyFloatVersion = common.floatVersion(version)
+    if (common.isHeadVersion(version)) {
+      console.log('Ruby master builds use included RubyGems')
+    } else if (rubyFloatVersion >= 3.0) {
+      await exec.exec(gem, ['update', '--system'])
+    } else if (rubyFloatVersion >= 2.6) {
+      await exec.exec(gem, ['update', '--system', '3.4.22'])
+    } else if (rubyFloatVersion >= 2.3) {
+      await exec.exec(gem, ['update', '--system', '3.3.27'])
+    } else {
+      console.log(`Cannot update RubyGems for Ruby version ${version}`)
+    }
+  } else {
+    // non MRI Rubies (TruffleRuby and JRuby)
+    await exec.exec(gem, ['update', '--system'])
+  }
+}