diff --git a/.rubocop.yml b/.rubocop.yml
index 2bb83225..a900a559 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -6,7 +6,7 @@ require:
   - rubocop-performance
 
 AllCops:
-  TargetRubyVersion: 2.5
+  TargetRubyVersion: 3.1
   DisplayCopNames: true
   Exclude:
     - 'Gemfile'
diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index 467ba7a9..066f81a9 100644
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -1,13 +1,13 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config`
-# on 2023-01-18 22:57:39 UTC using RuboCop version 0.93.1.
+# on 2023-11-03 20:55:41 UTC using RuboCop version 1.57.2.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
 # Offense count: 7
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: symmetrical, new_line, same_line
 Layout/MultilineMethodCallBraceLayout:
@@ -16,21 +16,21 @@ Layout/MultilineMethodCallBraceLayout:
     - 'spec/routing/media_routing_spec.rb'
 
 # Offense count: 7
-# Configuration parameters: IgnoredMethods.
+# Configuration parameters: AllowedMethods, AllowedPatterns, CountRepeatedAttributes.
 Metrics/AbcSize:
   Max: 22
 
 # Offense count: 2
-# Configuration parameters: IgnoredMethods.
+# Configuration parameters: AllowedMethods, AllowedPatterns.
 Metrics/CyclomaticComplexity:
   Max: 10
 
-# Offense count: 12
-# Configuration parameters: CountComments, CountAsOne, ExcludedMethods.
+# Offense count: 13
+# Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns.
 Metrics/MethodLength:
   Max: 25
 
-# Offense count: 34
+# Offense count: 35
 RSpec/AnyInstance:
   Exclude:
     - 'spec/controllers/media_controller_spec.rb'
@@ -44,7 +44,7 @@ RSpec/AnyInstance:
     - 'spec/requests/media_auth_request_spec.rb'
 
 # Offense count: 89
-# Configuration parameters: Prefixes.
+# Configuration parameters: Prefixes, AllowedPatterns.
 # Prefixes: when, with, without
 RSpec/ContextWording:
   Exclude:
@@ -62,23 +62,8 @@ RSpec/ContextWording:
     - 'spec/services/iiif_metadata_service_spec.rb'
     - 'spec/services/media_authentication_json_spec.rb'
 
-# Offense count: 10
-# Configuration parameters: IgnoredMetadata.
-RSpec/DescribeClass:
-  Exclude:
-    - 'spec/features/iiif_spec.rb'
-    - 'spec/features/status_spec.rb'
-    - 'spec/requests/iiif_spec.rb'
-    - 'spec/requests/remote_iiif_image_delivery_spec.rb'
-    - 'spec/routing/file_routing_spec.rb'
-    - 'spec/routing/iiif_routing_spec.rb'
-    - 'spec/routing/legacy_image_api_spec.rb'
-    - 'spec/routing/media_routing_spec.rb'
-    - 'spec/routing/webauth_routing_spec.rb'
-    - 'spec/views/webauth/logout.html.erb_spec.rb'
-
 # Offense count: 27
-# Cop supports --auto-correct.
+# This cop supports unsafe autocorrection (--autocorrect-all).
 # Configuration parameters: SkipBlocks, EnforcedStyle.
 # SupportedStyles: described_class, explicit
 RSpec/DescribedClass:
@@ -88,7 +73,7 @@ RSpec/DescribedClass:
     - 'spec/models/user_spec.rb'
 
 # Offense count: 7
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 RSpec/EmptyLineAfterExampleGroup:
   Exclude:
     - 'spec/abilities/ability_spec.rb'
@@ -96,7 +81,7 @@ RSpec/EmptyLineAfterExampleGroup:
     - 'spec/requests/file_auth_request_spec.rb'
 
 # Offense count: 37
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 RSpec/EmptyLineAfterFinalLet:
   Exclude:
     - 'spec/abilities/ability_spec.rb'
@@ -110,7 +95,8 @@ RSpec/EmptyLineAfterFinalLet:
     - 'spec/services/media_authentication_json_spec.rb'
 
 # Offense count: 6
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: AllowConsecutiveOneLiners.
 RSpec/EmptyLineAfterHook:
   Exclude:
     - 'spec/controllers/application_controller_spec.rb'
@@ -118,7 +104,7 @@ RSpec/EmptyLineAfterHook:
     - 'spec/requests/iiif_spec.rb'
 
 # Offense count: 12
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 RSpec/EmptyLineAfterSubject:
   Exclude:
     - 'spec/abilities/ability_spec.rb'
@@ -129,29 +115,24 @@ RSpec/EmptyLineAfterSubject:
     - 'spec/models/stacks_image_spec.rb'
     - 'spec/services/iiif_metadata_service_spec.rb'
 
-# Offense count: 22
-# Configuration parameters: Max.
+# Offense count: 20
+# Configuration parameters: CountAsOne.
 RSpec/ExampleLength:
-  Exclude:
-    - 'spec/controllers/iiif_controller_spec.rb'
-    - 'spec/controllers/legacy_image_service_controller_spec.rb'
-    - 'spec/controllers/object_controller_spec.rb'
-    - 'spec/features/iiif_spec.rb'
-    - 'spec/models/purl_spec.rb'
-    - 'spec/models/stacks_media_token_spec.rb'
-    - 'spec/requests/media_auth_request_spec.rb'
-    - 'spec/services/iiif_info_service_spec.rb'
+  Max: 24
 
-# Offense count: 2
-# Cop supports --auto-correct.
-# Configuration parameters: CustomTransform, IgnoredWords.
+# Offense count: 15
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: CustomTransform, IgnoredWords, DisallowedExamples.
+# DisallowedExamples: works
 RSpec/ExampleWording:
   Exclude:
+    - 'spec/controllers/legacy_image_service_controller_spec.rb'
     - 'spec/controllers/media_controller_spec.rb'
     - 'spec/models/stacks_media_token_spec.rb'
+    - 'spec/requests/iiif_auth_request_spec.rb'
 
 # Offense count: 3
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: implicit, each, example
 RSpec/HookArgument:
@@ -160,7 +141,7 @@ RSpec/HookArgument:
     - 'spec/requests/iiif_auth_request_spec.rb'
 
 # Offense count: 8
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 RSpec/LeadingSubject:
   Exclude:
     - 'spec/controllers/file_controller_spec.rb'
@@ -178,12 +159,13 @@ RSpec/MessageSpies:
     - 'spec/controllers/file_controller_spec.rb'
     - 'spec/controllers/media_controller_spec.rb'
 
-# Offense count: 66
+# Offense count: 67
 RSpec/MultipleExpectations:
   Max: 12
 
 # Offense count: 81
-# Configuration parameters: IgnoreSharedExamples.
+# Configuration parameters: EnforcedStyle, IgnoreSharedExamples.
+# SupportedStyles: always, named_only
 RSpec/NamedSubject:
   Exclude:
     - 'spec/controllers/application_controller_spec.rb'
@@ -201,7 +183,8 @@ RSpec/NamedSubject:
     - 'spec/services/iiif_metadata_service_spec.rb'
     - 'spec/services/media_authentication_json_spec.rb'
 
-# Offense count: 62
+# Offense count: 66
+# Configuration parameters: AllowedGroups.
 RSpec/NestedGroups:
   Max: 6
 
@@ -211,6 +194,12 @@ RSpec/RepeatedDescription:
     - 'spec/routing/file_routing_spec.rb'
     - 'spec/routing/legacy_image_api_spec.rb'
 
+# Offense count: 5
+RSpec/StubbedMock:
+  Exclude:
+    - 'spec/controllers/file_controller_spec.rb'
+    - 'spec/controllers/media_controller_spec.rb'
+
 # Offense count: 1
 RSpec/SubjectStub:
   Exclude:
@@ -235,17 +224,8 @@ Rails/FilePath:
     - 'app/controllers/application_controller.rb'
     - 'spec/controllers/file_controller_spec.rb'
 
-# Offense count: 12
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: numeric, symbolic
-Rails/HttpStatus:
-  Exclude:
-    - 'spec/requests/file_auth_request_spec.rb'
-    - 'spec/requests/iiif_auth_request_spec.rb'
-
 # Offense count: 2
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: separated, grouped
 Style/AccessorGrouping:
@@ -253,13 +233,13 @@ Style/AccessorGrouping:
     - 'app/models/stacks_image.rb'
 
 # Offense count: 2
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 Style/EmptyCaseCondition:
   Exclude:
     - 'app/controllers/legacy_image_service_controller.rb'
 
 # Offense count: 1
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: braces, no_braces
 Style/HashAsLastArrayItem:
@@ -267,7 +247,7 @@ Style/HashAsLastArrayItem:
     - 'app/controllers/object_controller.rb'
 
 # Offense count: 18
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: PreferredDelimiters.
 Style/PercentLiteralDelimiters:
   Exclude:
@@ -278,7 +258,8 @@ Style/PercentLiteralDelimiters:
     - 'spec/requests/media_auth_request_spec.rb'
 
 # Offense count: 3
-# Cop supports --auto-correct.
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: Mode.
 Style/StringConcatenation:
   Exclude:
     - 'app/controllers/iiif_controller.rb'
@@ -286,8 +267,16 @@ Style/StringConcatenation:
     - 'spec/models/stacks_media_token_spec.rb'
 
 # Offense count: 4
-# Cop supports --auto-correct.
+# This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: MinSize.
 # SupportedStyles: percent, brackets
 Style/SymbolArray:
   EnforcedStyle: brackets
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: AllowMethodsWithArguments, AllowedMethods, AllowedPatterns, AllowComments.
+# AllowedMethods: define_method
+Style/SymbolProc:
+  Exclude:
+    - 'app/controllers/webauth_controller.rb'
diff --git a/Gemfile b/Gemfile
index c81262ee..2c799a17 100644
--- a/Gemfile
+++ b/Gemfile
@@ -42,7 +42,7 @@ group :development, :test do
   gem 'webdrivers'
 
   # Rubocop is a static code analyzer to enforce style.
-  gem 'rubocop', '~> 0.50', require: false
+  gem 'rubocop', '~> 1.57', require: false
   gem 'rubocop-performance', require: false
   gem 'rubocop-rails', require: false
   gem 'rubocop-rspec', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 18f94b69..5aa5d91e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -201,7 +201,9 @@ GEM
     jbuilder (2.11.5)
       actionview (>= 5.0.0)
       activesupport (>= 5.0.0)
+    json (2.6.3)
     jwt (2.7.1)
+    language_server-protocol (3.17.0.3)
     listen (3.8.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
@@ -255,7 +257,7 @@ GEM
     public_suffix (5.0.3)
     puma (5.6.7)
       nio4r (~> 2.0)
-    racc (1.7.1)
+    racc (1.7.2)
     rack (2.2.8)
     rack-test (2.1.0)
       rack (>= 1.3)
@@ -324,17 +326,23 @@ GEM
       rspec-mocks (~> 3.10)
       rspec-support (~> 3.10)
     rspec-support (3.12.1)
-    rubocop (0.93.1)
+    rubocop (1.57.2)
+      json (~> 2.3)
+      language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
-      parser (>= 2.7.1.5)
+      parser (>= 3.2.2.4)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8)
-      rexml
-      rubocop-ast (>= 0.6.0)
+      regexp_parser (>= 1.8, < 3.0)
+      rexml (>= 3.2.5, < 4.0)
+      rubocop-ast (>= 1.28.1, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 2.0)
+      unicode-display_width (>= 2.4.0, < 3.0)
     rubocop-ast (1.30.0)
       parser (>= 3.2.1.0)
+    rubocop-capybara (2.19.0)
+      rubocop (~> 1.41)
+    rubocop-factory_bot (2.24.0)
+      rubocop (~> 1.33)
     rubocop-performance (1.10.2)
       rubocop (>= 0.90.0, < 2.0)
       rubocop-ast (>= 0.4.0)
@@ -342,9 +350,10 @@ GEM
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 0.90.0, < 2.0)
-    rubocop-rspec (1.44.1)
-      rubocop (~> 0.87)
-      rubocop-ast (>= 0.7.1)
+    rubocop-rspec (2.25.0)
+      rubocop (~> 1.40)
+      rubocop-capybara (~> 2.17)
+      rubocop-factory_bot (~> 2.22)
     ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
     rubyzip (2.3.2)
@@ -371,7 +380,7 @@ GEM
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.8.2)
-    unicode-display_width (1.8.0)
+    unicode-display_width (2.5.0)
     web-console (4.2.1)
       actionview (>= 6.0.0)
       activemodel (>= 6.0.0)
@@ -435,7 +444,7 @@ DEPENDENCIES
   redis
   retries
   rspec-rails (~> 5.0)
-  rubocop (~> 0.50)
+  rubocop (~> 1.57)
   rubocop-performance
   rubocop-rails
   rubocop-rspec
diff --git a/app/controllers/cdl_controller.rb b/app/controllers/cdl_controller.rb
index cee5f2f0..30c42ff8 100644
--- a/app/controllers/cdl_controller.rb
+++ b/app/controllers/cdl_controller.rb
@@ -38,11 +38,11 @@ def show_options
   #      - exp (due date)
   #      - barcode (note: the actual item barcode may differ from the one in the SDR item)
   def create
-    render json: 'invalid barcode', status: 400 and return unless barcode
+    render json: 'invalid barcode', status: :bad_request and return unless barcode
 
     checkout_params = {
       id: params[:id],
-      barcode: barcode,
+      barcode:,
       modal: true,
       return_to: cdl_checkout_success_iiif_auth_api_url(params[:id])
     }
@@ -66,12 +66,12 @@ def create_success
   def delete
     token = existing_payload[:token]
 
-    checkin_params = { token: token, return_to: cdl_checkin_success_iiif_auth_api_url(params[:id]) }
+    checkin_params = { token:, return_to: cdl_checkin_success_iiif_auth_api_url(params[:id]) }
     redirect_to "#{Settings.cdl.url}/checkin?#{checkin_params.to_param}"
   end
 
   def delete_success
-    # Note: the user may have lost its token already (because it was marked as expired)
+    # NOTE: the user may have lost its token already (because it was marked as expired)
     bad_tokens, good_tokens = current_user.cdl_tokens.partition { |payload| payload['aud'] == params[:id] }
     cookies.encrypted[:tokens] = good_tokens.pluck(:token) if bad_tokens.any?
 
@@ -84,7 +84,7 @@ def delete_success
   def renew
     token = existing_payload[:token]
 
-    renew_params = { modal: true, token: token, return_to: cdl_renew_success_iiif_auth_api_url(params[:id]) }
+    renew_params = { modal: true, token:, return_to: cdl_renew_success_iiif_auth_api_url(params[:id]) }
     redirect_to "#{Settings.cdl.url}/renew?#{renew_params.to_param}"
   end
 
diff --git a/app/controllers/concerns/current_user_concern.rb b/app/controllers/concerns/current_user_concern.rb
index a2bc6c66..e44b405c 100644
--- a/app/controllers/concerns/current_user_concern.rb
+++ b/app/controllers/concerns/current_user_concern.rb
@@ -57,7 +57,7 @@ def webauth_user
     User.new(id: session[:remote_user] || request.remote_user,
              ip_address: request.remote_ip,
              webauth_user: true,
-             ldap_groups: ldap_groups,
+             ldap_groups:,
              jwt_tokens: cookies.encrypted[:tokens]).tap { |user| clean_up_expired_cdl_tokens(user) }
   end
 
diff --git a/app/controllers/file_controller.rb b/app/controllers/file_controller.rb
index d65c42bb..bd94286d 100644
--- a/app/controllers/file_controller.rb
+++ b/app/controllers/file_controller.rb
@@ -16,7 +16,7 @@ def show
     response.headers['Content-Length'] = current_file.content_length
     response.headers.delete('X-Frame-Options')
 
-    send_file current_file.path, disposition: disposition
+    send_file current_file.path, disposition:
   end
 
   def options
diff --git a/app/controllers/iiif_controller.rb b/app/controllers/iiif_controller.rb
index b83db507..d58a6170 100644
--- a/app/controllers/iiif_controller.rb
+++ b/app/controllers/iiif_controller.rb
@@ -33,9 +33,7 @@ def show
   # IIIF info.json endpoint
   # rubocop:disable Metrics/PerceivedComplexity
   def metadata
-    unless Rails.env.development?
-      raise ActionController::MissingFile, 'File Not Found' unless current_image.exist?
-    end
+    raise ActionController::MissingFile, 'File Not Found' if !Rails.env.development? && !current_image.exist?
 
     return unless stale?(**cache_headers_metadata)
 
@@ -55,7 +53,7 @@ def metadata
 
     respond_to do |format|
       format.any(:json, :jsonld) do
-        render json: image_info, status: status
+        render json: image_info, status:
       end
     end
   end
@@ -126,16 +124,16 @@ def set_attachment_content_disposition_header
 
   def current_image
     @image ||= begin
-                 img = StacksImage.new(stacks_image_params)
-                 can?(:download, img) ? img : img.restricted
-               end
+      img = StacksImage.new(stacks_image_params)
+      can?(:download, img) ? img : img.restricted
+    end
   end
 
   def identifier_params
     return params.permit(:id, :file_name).to_h if params[:id] && params[:file_name]
 
     id, file_name = params[:identifier].sub('/', '%2F').split('%2F', 2)
-    { id: id, file_name: file_name }
+    { id:, file_name: }
   end
 
   def stacks_image_params
diff --git a/app/controllers/iiif_token_controller.rb b/app/controllers/iiif_token_controller.rb
index 390f3d0c..6b3c4ce5 100644
--- a/app/controllers/iiif_token_controller.rb
+++ b/app/controllers/iiif_token_controller.rb
@@ -85,7 +85,7 @@ def create_for_json_access_token_auth(token)
                    :unauthorized
                  end
 
-        render json: @message.to_json, callback: callback_value, status: status
+        render json: @message.to_json, callback: callback_value, status:
       end
     end
   end
diff --git a/app/controllers/legacy_image_service_controller.rb b/app/controllers/legacy_image_service_controller.rb
index 2f459cc4..0752a13a 100644
--- a/app/controllers/legacy_image_service_controller.rb
+++ b/app/controllers/legacy_image_service_controller.rb
@@ -16,7 +16,7 @@ def show
   def iiif_options
     @image.transformation
           .to_params
-          .merge(id: id, file_name: file_name,
+          .merge(id:, file_name:,
                  download: allowed_params[:download])
   end
 
@@ -86,7 +86,7 @@ def iiif_region
   end
 
   def identifier_params
-    { id: id, file_name: file_name }
+    { id:, file_name: }
   end
 
   def id
diff --git a/app/models/iiif_image.rb b/app/models/iiif_image.rb
index 29592caa..da2f0dbe 100644
--- a/app/models/iiif_image.rb
+++ b/app/models/iiif_image.rb
@@ -29,7 +29,7 @@ def response
   private
 
   def image_uri
-    @image_uri ||= IIIF::Image::URI.new(base_uri: @base_uri, identifier: remote_id, transformation: transformation)
+    @image_uri ||= IIIF::Image::URI.new(base_uri: @base_uri, identifier: remote_id, transformation:)
   end
 
   def image_url
@@ -37,7 +37,7 @@ def image_url
   end
 
   def remote_id
-    CGI.escape(StacksFile.new(id: id, file_name: file_name).treeified_path)
+    CGI.escape(StacksFile.new(id:, file_name:).treeified_path)
   end
 
   attr_reader :transformation, :id, :file_name
diff --git a/app/models/projection.rb b/app/models/projection.rb
index b8006281..d26e1613 100644
--- a/app/models/projection.rb
+++ b/app/models/projection.rb
@@ -51,7 +51,7 @@ def explicit_tile_dimensions(requested_size)
             else
               requested_size.width
             end
-    IIIF::Image::Dimension.new(width: width, height: height)
+    IIIF::Image::Dimension.new(width:, height:)
   end
 
   def absolute_region?
@@ -108,7 +108,7 @@ def square_region_dimensions
 
   # @return [IiifImage]
   def image_source
-    @image_source ||= IiifImage.new(id: id, file_name: file_name, transformation: real_transformation)
+    @image_source ||= IiifImage.new(id:, file_name:, transformation: real_transformation)
   end
 
   def real_transformation
diff --git a/app/models/stacks_file.rb b/app/models/stacks_file.rb
index 68081abd..ee4c75de 100644
--- a/app/models/stacks_file.rb
+++ b/app/models/stacks_file.rb
@@ -40,13 +40,11 @@ def treeified_path
   end
 
   def druid_parts
-    @druid_parts ||= begin
-      id.match(/^([a-z]{2})(\d{3})([a-z]{2})(\d{4})$/i)
-    end
+    @druid_parts ||= id.match(/^([a-z]{2})(\d{3})([a-z]{2})(\d{4})$/i)
   end
 
   def stacks_rights
-    @stacks_rights ||= StacksRights.new(id: id, file_name: file_name)
+    @stacks_rights ||= StacksRights.new(id:, file_name:)
   end
   delegate :rights, to: :stacks_rights
 end
diff --git a/app/models/stacks_image.rb b/app/models/stacks_image.rb
index 9e0dee33..b6cadcbb 100644
--- a/app/models/stacks_image.rb
+++ b/app/models/stacks_image.rb
@@ -10,10 +10,10 @@ class StacksImage
 
   # @return [RestrictedImage] the restricted version of this image
   def restricted
-    RestrictedImage.new(transformation: transformation,
-                        id: id,
-                        file_name: file_name,
-                        canonical_url: canonical_url)
+    RestrictedImage.new(transformation:,
+                        id:,
+                        file_name:,
+                        canonical_url:)
   end
 
   # @return [Hash]
@@ -51,16 +51,16 @@ def projection_for(transformation)
 
   # @return [StacksFile]
   def file_source
-    @file_source ||= StacksFile.new(id: id, file_name: file_name)
+    @file_source ||= StacksFile.new(id:, file_name:)
   end
 
   # @return [InfoService]
   def info_service
-    @info_service ||= IiifMetadataService.new(id: id, file_name: file_name, canonical_url: canonical_url)
+    @info_service ||= IiifMetadataService.new(id:, file_name:, canonical_url:)
   end
 
   def stacks_rights
-    @stacks_rights ||= StacksRights.new(id: id, file_name: file_name)
+    @stacks_rights ||= StacksRights.new(id:, file_name:)
   end
   delegate :rights, :maybe_downloadable?, :object_thumbnail?,
            :stanford_restricted?, :restricted_by_location?, :cdl_restricted?, to: :stacks_rights
diff --git a/app/models/stacks_media_stream.rb b/app/models/stacks_media_stream.rb
index 24c1e8b8..4f2d5f9d 100644
--- a/app/models/stacks_media_stream.rb
+++ b/app/models/stacks_media_stream.rb
@@ -7,7 +7,7 @@ class StacksMediaStream
 
   # @return [StacksFile] the file on disk that back this projection
   def file
-    @file ||= StacksFile.new(id: id, file_name: file_name)
+    @file ||= StacksFile.new(id:, file_name:)
   end
 
   attr_accessor :format, :id, :file_name
@@ -15,7 +15,7 @@ def file
   delegate :etag, :mtime, to: :file
 
   def stacks_rights
-    @stacks_rights ||= StacksRights.new(id: id, file_name: file_name)
+    @stacks_rights ||= StacksRights.new(id:, file_name:)
   end
   delegate :rights, :restricted_by_location?, :stanford_restricted?, to: :stacks_rights
 end
diff --git a/app/models/stacks_media_token.rb b/app/models/stacks_media_token.rb
index b59bbc82..73873a23 100644
--- a/app/models/stacks_media_token.rb
+++ b/app/models/stacks_media_token.rb
@@ -64,10 +64,10 @@ def initialize(id, file_name, user_ip)
 
   def to_hash
     {
-      id: id,
-      file_name: file_name,
-      user_ip: user_ip,
-      timestamp: timestamp
+      id:,
+      file_name:,
+      user_ip:,
+      timestamp:
     }
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 2daa0c94..cd6c5e78 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -68,7 +68,7 @@ def decode_token(token)
     payload, headers = JWT.decode(token, Settings.cdl.jwt.secret, true, {
                                     algorithm: Settings.cdl.jwt.algorithm, sub: id, verify_sub: true
                                   })
-    [payload&.merge(token: token)&.with_indifferent_access, headers]
+    [payload&.merge(token:)&.with_indifferent_access, headers]
   rescue JWT::ExpiredSignature, JWT::InvalidSubError
     nil
   end
@@ -105,7 +105,7 @@ def token
     self.class.encryptor.encrypt_and_sign(
       [
         # stored parameters
-        { id: id, ldap_groups: ldap_groups, ip_address: ip_address, jwt_tokens: jwt_tokens },
+        { id:, ldap_groups:, ip_address:, jwt_tokens: },
         # mint time
         mint_time,
         # expiry time
diff --git a/app/services/iiif_metadata_service.rb b/app/services/iiif_metadata_service.rb
index f2ddc9d2..698ac613 100644
--- a/app/services/iiif_metadata_service.rb
+++ b/app/services/iiif_metadata_service.rb
@@ -11,8 +11,8 @@ class IiifMetadataService
   # @param canonical_url [String]
   # @param base_uri [String] base path to the IIIF server
   def initialize(id:, file_name:, canonical_url:, base_uri: Settings.imageserver.base_uri)
-    identifier = CGI.escape(StacksFile.new(id: id, file_name: file_name).treeified_path)
-    @url = IIIF::Image::URI.new(identifier: identifier, base_uri: base_uri).to_s
+    identifier = CGI.escape(StacksFile.new(id:, file_name:).treeified_path)
+    @url = IIIF::Image::URI.new(identifier:, base_uri:).to_s
     @canonical_url = canonical_url
   end
 
@@ -68,11 +68,9 @@ def handle_response(conn)
 
   def json
     retrieved_json = retrieve
-    @json ||= begin
-                JSON.parse(retrieved_json).tap do |data|
-                  data['@id'] = @canonical_url
-                end
-              end
+    @json ||= JSON.parse(retrieved_json).tap do |data|
+      data['@id'] = @canonical_url
+    end
   rescue JSON::ParserError => e
     raise Stacks::UnexpectedMetadataResponseError, "There was a problem fetching #{@url}. #{e}: #{retrieved_json}"
   end
diff --git a/spec/abilities/ability_spec.rb b/spec/abilities/ability_spec.rb
index 98a06df4..1f5b020e 100644
--- a/spec/abilities/ability_spec.rb
+++ b/spec/abilities/ability_spec.rb
@@ -1043,7 +1043,7 @@
 
   describe 'for an object with CDL rights' do
     let(:user) do
-      User.new(id: 'a', webauth_user: true, ldap_groups: %w(stanford:stanford), jwt_tokens: jwt_tokens)
+      User.new(id: 'a', webauth_user: true, ldap_groups: %w(stanford:stanford), jwt_tokens:)
     end
     let(:jwt_tokens) { [] }
     let(:rights_xml) do
diff --git a/spec/controllers/file_controller_spec.rb b/spec/controllers/file_controller_spec.rb
index d81b4557..eb530b56 100644
--- a/spec/controllers/file_controller_spec.rb
+++ b/spec/controllers/file_controller_spec.rb
@@ -16,7 +16,7 @@
 
     before do
       path = File.join(Rails.root, 'spec/fixtures/nr/349/ct/7889/image.jp2')
-      allow(file).to receive_messages(mtime: Time.zone.now, path: path)
+      allow(file).to receive_messages(mtime: Time.zone.now, path:)
     end
 
     it 'sends the file to the user' do
diff --git a/spec/controllers/iiif_controller_spec.rb b/spec/controllers/iiif_controller_spec.rb
index 47097e2f..007d5293 100644
--- a/spec/controllers/iiif_controller_spec.rb
+++ b/spec/controllers/iiif_controller_spec.rb
@@ -20,7 +20,7 @@
 
     let(:iiif_params) do
       {
-        identifier: identifier,
+        identifier:,
         region: '0,640,2552,2552',
         size: '100,100',
         rotation: '0',
diff --git a/spec/controllers/media_controller_spec.rb b/spec/controllers/media_controller_spec.rb
index b2b96f37..0a3ea892 100644
--- a/spec/controllers/media_controller_spec.rb
+++ b/spec/controllers/media_controller_spec.rb
@@ -16,21 +16,21 @@
     context 'mock #token_valid?' do
       it 'verifies a token when token_valid? returns true' do
         expect(controller).to receive(:token_valid?).with(encrypted_token, id, file_name, ip_addr).and_return true
-        get :verify_token, params: { stacks_token: encrypted_token, id: id, file_name: file_name, user_ip: ip_addr }
+        get :verify_token, params: { stacks_token: encrypted_token, id:, file_name:, user_ip: ip_addr }
         expect(response.body).to eq 'valid token'
         expect(response.status).to eq 200
       end
 
       it 'rejects a token when token_valid? returns false' do
         expect(controller).to receive(:token_valid?).with(encrypted_token, id, file_name, ip_addr).and_return false
-        get :verify_token, params: { stacks_token: encrypted_token, id: id, file_name: file_name, user_ip: ip_addr }
+        get :verify_token, params: { stacks_token: encrypted_token, id:, file_name:, user_ip: ip_addr }
         expect(response.body).to eq 'invalid token'
         expect(response.status).to eq 403
       end
     end
 
     context 'actually try to verify the token' do
-      let(:valid_token) { { stacks_token: encrypted_token, id: id, file_name: file_name, user_ip: ip_addr } }
+      let(:valid_token) { { stacks_token: encrypted_token, id:, file_name:, user_ip: ip_addr } }
       # these tests are a bit more integration-ish, since they actually end up calling
       # StacksMediaToken.verify_encrypted_token? instead of mocking the call to MediaController#token_valid?
       it 'verifies a valid token' do
@@ -88,7 +88,7 @@
     it 'returns JSON from hash_for_auth_check' do
       test_hash = { foo: :bar }
       expect(controller).to receive(:hash_for_auth_check).and_return(test_hash)
-      get :auth_check, params: { id: id, file_name: file_name, format: :js }
+      get :auth_check, params: { id:, file_name:, format: :js }
       body = JSON.parse(response.body)
       expect(body).to eq('foo' => 'bar')
     end
@@ -101,7 +101,7 @@
       end
 
       it 'returns json that indicates a successful auth check (including token)' do
-        get :auth_check, params: { id: id, file_name: file_name, format: :js }
+        get :auth_check, params: { id:, file_name:, format: :js }
         body = JSON.parse(response.body)
         expect(body['status']).to eq 'success'
         expect(body['token']).to eq 'sekret-token'
diff --git a/spec/controllers/webauth_controller_spec.rb b/spec/controllers/webauth_controller_spec.rb
index 3b9bb3bd..358b2591 100644
--- a/spec/controllers/webauth_controller_spec.rb
+++ b/spec/controllers/webauth_controller_spec.rb
@@ -19,7 +19,7 @@
   end
 
   describe '#login_file' do
-    subject { get :login_file, params: params }
+    subject { get :login_file, params: }
     let(:params) { { id: 'xf680rd3068', file_name: 'xf680rd3068_1.jp2' } }
 
     it 'returns the user to the file api' do
@@ -27,12 +27,12 @@
     end
 
     it 'stores user information in the session' do
-      get :login_file, params: params
+      get(:login_file, params:)
       expect(session.to_h).to include 'remote_user' => 'username', 'workgroups' => 'a;b'
     end
 
     context 'with a failed login' do
-      subject { get :login_file, params: params }
+      subject { get :login_file, params: }
 
       before do
         allow(controller).to receive(:current_user).and_return(nil)
@@ -45,7 +45,7 @@
   end
 
   describe '#login_iiif' do
-    subject { get :login_iiif, params: params }
+    subject { get :login_iiif, params: }
     let(:params) do
       {
         id: 'nr349ct7889',
@@ -59,7 +59,7 @@
     end
 
     it 'stores user information in the session' do
-      get :login_iiif, params: params
+      get(:login_iiif, params:)
       expect(session.to_h).to include 'remote_user' => 'username', 'workgroups' => 'a;b'
     end
 
diff --git a/spec/models/iiif_image_spec.rb b/spec/models/iiif_image_spec.rb
index 7e1bc53a..99c19541 100644
--- a/spec/models/iiif_image_spec.rb
+++ b/spec/models/iiif_image_spec.rb
@@ -6,9 +6,9 @@
   let(:base_uri) { 'https://imageserver.example.com/cantaloupe/iiif/2/' }
   let(:transformation) { IIIF::Image::Transformation.new(size: 'full', region: 'full') }
   let(:instance) do
-    described_class.new(base_uri: base_uri,
+    described_class.new(base_uri:,
                         id: 'st808xq5141', file_name: 'st808xq5141_00_0001.jp2',
-                        transformation: transformation)
+                        transformation:)
   end
 
   describe "#remote_id" do
diff --git a/spec/models/purl_spec.rb b/spec/models/purl_spec.rb
index 668688cd..991445a9 100644
--- a/spec/models/purl_spec.rb
+++ b/spec/models/purl_spec.rb
@@ -41,7 +41,7 @@
             </contentMetadata>
           </publicObject>
           EOXML
-              )
+        )
       )
 
       actual = described_class.files('abc').map { |file| "#{file.id}/#{file.file_name}" }
diff --git a/spec/models/stacks_image_spec.rb b/spec/models/stacks_image_spec.rb
index 0526be2a..90e82893 100644
--- a/spec/models/stacks_image_spec.rb
+++ b/spec/models/stacks_image_spec.rb
@@ -57,7 +57,7 @@
     let(:attributes) do
       { id: 'ab012cd3456', file_name: 'def',
         canonical_url: 'http://example.com/',
-        transformation: transformation }
+        transformation: }
     end
 
     it 'passes all the parameters' do
diff --git a/spec/requests/file_auth_request_spec.rb b/spec/requests/file_auth_request_spec.rb
index d44c781c..5d12fedd 100644
--- a/spec/requests/file_auth_request_spec.rb
+++ b/spec/requests/file_auth_request_spec.rb
@@ -106,7 +106,7 @@
           allow_any_instance_of(FileController).to receive(:current_user).and_return(user_webauth_no_stanford_no_loc)
           allow(Purl).to receive(:public_xml).and_return(group_rights)
           get "/file/#{druid}/#{filename}"
-          expect(response).to have_http_status(403)
+          expect(response).to have_http_status(:forbidden)
         end
       end
       it "prompts for webauth when user not webauthed" do
@@ -129,7 +129,7 @@
           allow_any_instance_of(FileController).to receive(:current_user).and_return(user_no_loc_no_webauth)
           allow(Purl).to receive(:public_xml).and_return(location_other_rights)
           get "/file/#{druid}/#{filename}"
-          expect(response).to have_http_status(403)
+          expect(response).to have_http_status(:forbidden)
         end
       end
       context 'OR stanford' do
@@ -161,7 +161,7 @@
               allow_any_instance_of(FileController).to receive(:current_user).and_return(user_webauth_no_stanford_no_loc)
               allow(Purl).to receive(:public_xml).and_return(stanford_and_location_other_rights)
               get "/file/#{druid}/#{filename}"
-              expect(response).to have_http_status(403)
+              expect(response).to have_http_status(:forbidden)
             end
           end
         end
diff --git a/spec/requests/iiif_auth_request_spec.rb b/spec/requests/iiif_auth_request_spec.rb
index f37e6adf..558b4e06 100644
--- a/spec/requests/iiif_auth_request_spec.rb
+++ b/spec/requests/iiif_auth_request_spec.rb
@@ -17,8 +17,8 @@
   let(:quality) { 'default' }
   let(:format) { 'jpg' }
   let(:identifier) { 'nr349ct7889%2Fnr349ct7889_00_0001' }
-  let(:params_hash) { { id: 'nr349ct7889', file_name: 'nr349ct7889_00_0001', transformation: transformation } }
-  let(:transformation) { IIIF::Image::Transformation.new region: region, size: size, rotation: rotation, quality: quality, format: format }
+  let(:params_hash) { { id: 'nr349ct7889', file_name: 'nr349ct7889_00_0001', transformation: } }
+  let(:transformation) { IIIF::Image::Transformation.new region:, size:, rotation:, quality:, format: }
   let(:path) { "/stacks/nr/349/ct/7889/nr349ct7889_00_0001" }
   let(:perms) { nil }
   let(:current_image) { StacksImage.new(params_hash) }
@@ -49,7 +49,7 @@
 
         it 'works' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(200)
+          expect(response).to have_http_status(:ok)
           expect(response.media_type).to eq('image/jpeg')
         end
       end
@@ -65,7 +65,7 @@
 
         it 'works' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(200)
+          expect(response).to have_http_status(:ok)
           expect(response.media_type).to eq('image/jpeg')
         end
       end
@@ -75,7 +75,7 @@
 
         it 'blocks' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(403)
+          expect(response).to have_http_status(:forbidden)
         end
       end
 
@@ -84,7 +84,7 @@
 
         it 'redirects to the authentication endpoint' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to redirect_to(auth_iiif_url(id: 'nr349ct7889', file_name: 'nr349ct7889_00_0001', format: format))
+          expect(response).to redirect_to(auth_iiif_url(id: 'nr349ct7889', file_name: 'nr349ct7889_00_0001', format:))
         end
       end
     end
@@ -99,7 +99,7 @@
 
         it 'works' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(200)
+          expect(response).to have_http_status(:ok)
           expect(response.media_type).to eq('image/jpeg')
         end
       end
@@ -109,7 +109,7 @@
 
         it 'blocks' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(403)
+          expect(response).to have_http_status(:forbidden)
         end
       end
     end
@@ -137,7 +137,7 @@
 
         it 'works' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(200)
+          expect(response).to have_http_status(:ok)
           expect(response.media_type).to eq('image/jpeg')
         end
       end
@@ -147,7 +147,7 @@
 
         it 'blocks' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(403)
+          expect(response).to have_http_status(:forbidden)
         end
       end
 
@@ -156,7 +156,7 @@
 
         it 'works' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(200)
+          expect(response).to have_http_status(:ok)
           expect(response.media_type).to eq('image/jpeg')
         end
       end
@@ -166,7 +166,7 @@
 
         it 'works' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to have_http_status(200)
+          expect(response).to have_http_status(:ok)
           expect(response.media_type).to eq('image/jpeg')
         end
       end
@@ -176,7 +176,7 @@
 
         it 'redirects to the authentication endpoint' do
           get "/image/iiif/#{identifier}/#{region}/#{size}/#{rotation}/#{quality}.#{format}"
-          expect(response).to redirect_to(auth_iiif_url(id: 'nr349ct7889', file_name: 'nr349ct7889_00_0001', format: format))
+          expect(response).to redirect_to(auth_iiif_url(id: 'nr349ct7889', file_name: 'nr349ct7889_00_0001', format:))
         end
       end
     end
diff --git a/spec/requests/media_auth_request_spec.rb b/spec/requests/media_auth_request_spec.rb
index 69143cf1..915ff7c1 100644
--- a/spec/requests/media_auth_request_spec.rb
+++ b/spec/requests/media_auth_request_spec.rb
@@ -31,7 +31,7 @@
     end
 
     let(:mock_media) do
-      sms = StacksMediaStream.new(id: 'bb582xs1304', file_name: 'file', format: format)
+      sms = StacksMediaStream.new(id: 'bb582xs1304', file_name: 'file', format:)
       allow(Purl).to receive(:public_xml).with('bb582xs1304').and_return(public_xml)
       sms
     end
diff --git a/spec/services/iiif_metadata_service_spec.rb b/spec/services/iiif_metadata_service_spec.rb
index 105eb73e..ccb5af90 100644
--- a/spec/services/iiif_metadata_service_spec.rb
+++ b/spec/services/iiif_metadata_service_spec.rb
@@ -4,7 +4,7 @@
 
 RSpec.describe IiifMetadataService do
   let(:base_uri) { 'https://sul-imageserver-uat.stanford.edu/cantaloupe/iiif/2/' } # 'image-server-path'
-  let(:service) { described_class.new(id: 'nr349ct7889', file_name: 'nr349ct7889_00_0001.jp2', canonical_url: 'foo', base_uri: base_uri) }
+  let(:service) { described_class.new(id: 'nr349ct7889', file_name: 'nr349ct7889_00_0001.jp2', canonical_url: 'foo', base_uri:) }
   let(:http_client) { instance_double(HTTP::Client) }
 
   context "When a valid JSON response is received" do
diff --git a/spec/services/media_authentication_json_spec.rb b/spec/services/media_authentication_json_spec.rb
index 45f7bb52..8f4401bf 100644
--- a/spec/services/media_authentication_json_spec.rb
+++ b/spec/services/media_authentication_json_spec.rb
@@ -13,7 +13,7 @@
   end
   let(:ability) { Ability.new(user) }
   let(:user) { double('User', locations: [], webauth_user: false, stanford?: false, app_user?: false, cdl_tokens: []) }
-  subject { described_class.new(media: media, user: user, auth_url: '/the/auth/url', ability: ability) }
+  subject { described_class.new(media:, user:, auth_url: '/the/auth/url', ability:) }
 
   describe 'Location Restricted Media' do
     before do