diff --git a/oc-chef-pedant/Gemfile b/oc-chef-pedant/Gemfile
index 2150787063..528debc875 100644
--- a/oc-chef-pedant/Gemfile
+++ b/oc-chef-pedant/Gemfile
@@ -10,7 +10,7 @@ gem "rake"
 # We require chef internally to get the version in
 # lib/pedant/request.rb. It's really strange code and it should be
 # revisited.
-gem "chef", "18.8.11"
+gem "chef", "18.8.46"
 
 # For "rake chef_zero_spec"
 # gem 'chef-zero', github: 'chef/chef-zero'
diff --git a/oc-chef-pedant/Gemfile.lock b/oc-chef-pedant/Gemfile.lock
index 2ece5208b1..0771d36d7a 100644
--- a/oc-chef-pedant/Gemfile.lock
+++ b/oc-chef-pedant/Gemfile.lock
@@ -60,13 +60,13 @@ GEM
       debug_inspector (>= 1.2.0)
     builder (3.3.0)
     byebug (12.0.0)
-    chef (18.8.11)
-      activesupport (>= 4.2.7.1, <= 7.1.3.2)
+    chef (18.8.46)
+      activesupport (>= 4.2.7.1, <= 7.1.5.2)
       addressable
       aws-sdk-s3 (~> 1.91)
       aws-sdk-secretsmanager (~> 1.46)
-      chef-config (= 18.8.11)
-      chef-utils (= 18.8.11)
+      chef-config (= 18.8.46)
+      chef-utils (= 18.8.46)
       chef-vault
       chef-zero (>= 15.0.21)
       corefoundation (~> 0.3.4)
@@ -89,16 +89,16 @@ GEM
       plist (~> 3.2)
       proxifier2 (~> 1.1)
       syslog-logger (~> 1.6)
-      train-core (~> 3.10, <= 3.12.13)
+      train-core (~> 3.13, >= 3.13.4)
       train-rest (>= 0.4.1)
       train-winrm (~> 0.2.17)
       unf_ext (~> 0.0.8.2)
       uri (~> 1.0.3)
       uuidtools (>= 2.1.5, < 3.0)
       vault (~> 0.18.2)
-    chef-config (18.8.11)
+    chef-config (18.8.46)
       addressable
-      chef-utils (= 18.8.11)
+      chef-utils (= 18.8.46)
       fuzzyurl
       mixlib-config (>= 2.2.12, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
@@ -109,7 +109,7 @@ GEM
     chef-telemetry (1.1.1)
       chef-config
       concurrent-ruby (~> 1.0)
-    chef-utils (18.8.11)
+    chef-utils (18.8.46)
       concurrent-ruby
     chef-vault (4.1.23)
     chef-winrm (2.3.12)
@@ -181,7 +181,7 @@ GEM
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     iniparse (1.5.0)
-    inspec-core (5.22.95)
+    inspec-core (5.23.6)
       addressable (~> 2.4)
       chef-telemetry (~> 1.0, >= 1.0.8)
       cookstyle
@@ -202,7 +202,7 @@ GEM
       sslshake (~> 1.2)
       thor (>= 0.20, < 1.5.0)
       tomlrb (>= 1.2, < 2.1)
-      train-core (~> 3.12.13)
+      train-core (~> 3.13, >= 3.13.4)
       tty-prompt (~> 0.17)
       tty-table (~> 0.10)
     ipaddress (0.8.3)
@@ -353,9 +353,9 @@ GEM
       date
     timeout (0.4.3)
     tomlrb (1.3.0)
-    train-core (3.12.13)
+    train-core (3.13.4)
       addressable (~> 2.5)
-      ffi (!= 1.13.0)
+      ffi (~> 1.16.0)
       json (>= 1.8, < 3.0)
       mixlib-shellout (>= 2.0, < 4.0)
       net-scp (>= 1.2, < 5.0)
@@ -404,7 +404,7 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
-  chef (= 18.8.11)
+  chef (= 18.8.46)
   oc-chef-pedant!
   pry
   pry-byebug
diff --git a/oc-chef-pedant/Rakefile b/oc-chef-pedant/Rakefile
index 47c37d7b7a..09148e089b 100644
--- a/oc-chef-pedant/Rakefile
+++ b/oc-chef-pedant/Rakefile
@@ -27,7 +27,7 @@ def bundle_exec_with_chef(test_gem, commands)
       # TODO: one of workaround to fix verify pipeline failure
       # Could not found another way to update chef version without releasing new chef-zero  gem
       elsif line =~ /^\s*gem\s*['"]chef['"]\s*,?.*$/ # foodcritic      end
-        line = "gem \"chef\", \"~> 18.8.11\""
+        line = "gem \"chef\", \"~> 18.8.46\""
       elsif line =~ /^\s*gem\s*['"]ohai['"]\s*,?.*$/ # foodcritic      end
         line = "gem \"ohai\", \"~> 18.0\""
       elsif line =~ /\s*gem\s*['"]#{test_gem}['"]/ # foodcritic      end
diff --git a/omnibus/Gemfile b/omnibus/Gemfile
index c0e4b89a2e..0519797cf7 100644
--- a/omnibus/Gemfile
+++ b/omnibus/Gemfile
@@ -12,6 +12,6 @@ group :test do
   gem 'test-kitchen' # for Test Kitchen testing of the omnibus builds
   gem 'berkshelf', '~> 8.0.22' # depsolving the Test Kitchen suite
   gem 'archive-tar-minitar' # required by berkshelf for packaging
-  gem 'chef', '~> 18.8.11'
+  gem 'chef', '~> 18.8.46'
   gem 'rake'
 end
diff --git a/omnibus/Gemfile.lock b/omnibus/Gemfile.lock
index cb7690472c..cd36018613 100644
--- a/omnibus/Gemfile.lock
+++ b/omnibus/Gemfile.lock
@@ -39,15 +39,18 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.1.3.2)
+    activesupport (7.1.5.2)
       base64
+      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
       minitest (>= 5.1)
       mutex_m
+      securerandom (>= 0.3)
       tzinfo (~> 2.0)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
@@ -80,6 +83,7 @@ GEM
     base64 (0.3.0)
     bcrypt_pbkdf (1.1.1)
     bcrypt_pbkdf (1.1.1-arm64-darwin)
+    benchmark (0.5.0)
     berkshelf (8.0.22)
       chef (>= 18.0.0)
       chef-cleanroom (~> 1.0)
@@ -96,13 +100,14 @@ GEM
       thor (>= 0.20, < 1.3.0)
     bigdecimal (3.2.2)
     builder (3.3.0)
-    chef (18.8.11)
-      activesupport (>= 4.2.7.1, <= 7.1.3.2)
+    cgi (0.5.0)
+    chef (18.8.46)
+      activesupport (>= 4.2.7.1, <= 7.1.5.2)
       addressable
       aws-sdk-s3 (~> 1.91)
       aws-sdk-secretsmanager (~> 1.46)
-      chef-config (= 18.8.11)
-      chef-utils (= 18.8.11)
+      chef-config (= 18.8.46)
+      chef-utils (= 18.8.46)
       chef-vault
       chef-zero (>= 15.0.21)
       corefoundation (~> 0.3.4)
@@ -125,7 +130,7 @@ GEM
       plist (~> 3.2)
       proxifier2 (~> 1.1)
       syslog-logger (~> 1.6)
-      train-core (~> 3.10, <= 3.12.13)
+      train-core (~> 3.13, >= 3.13.4)
       train-rest (>= 0.4.1)
       train-winrm (~> 0.2.17)
       unf_ext (~> 0.0.8.2)
@@ -133,9 +138,9 @@ GEM
       uuidtools (>= 2.1.5, < 3.0)
       vault (~> 0.18.2)
     chef-cleanroom (1.0.5)
-    chef-config (18.8.11)
+    chef-config (18.8.46)
       addressable
-      chef-utils (= 18.8.11)
+      chef-utils (= 18.8.46)
       fuzzyurl
       mixlib-config (>= 2.2.12, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
@@ -146,9 +151,10 @@ GEM
     chef-telemetry (1.1.1)
       chef-config
       concurrent-ruby (~> 1.0)
-    chef-utils (18.8.11)
+    chef-utils (18.8.46)
       concurrent-ruby
-    chef-vault (4.1.23)
+    chef-vault (4.2.5)
+      syslog (~> 0.3)
     chef-winrm (2.3.12)
       builder (>= 2.1.2)
       chef-gyoku (~> 1.4.0, <= 1.4.5)
@@ -182,24 +188,27 @@ GEM
     citrus (3.0.2)
     coderay (1.1.3)
     concurrent-ruby (1.3.5)
-    connection_pool (2.5.3)
+    connection_pool (2.5.4)
     contracts (0.16.1)
-    cookstyle (8.4.0)
-      rubocop (= 1.79.2)
+    cookstyle (8.5.0)
+      rubocop (= 1.81.0)
     corefoundation (0.3.13)
       ffi (>= 1.15.0)
+    csv (3.3.5)
     date (3.4.1)
     diff-lcs (1.5.1)
     domain_name (0.6.20240107)
     drb (2.2.3)
     ed25519 (1.4.0)
+    erb (4.0.4)
+      cgi (>= 0.3.3)
     erubi (1.13.1)
     erubis (2.7.0)
     faraday (2.13.4)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-follow_redirects (0.3.0)
+    faraday-follow_redirects (0.4.0)
       faraday (>= 1, < 3)
     faraday-net_http (3.4.1)
       net-http (>= 0.5.0)
@@ -216,14 +225,14 @@ GEM
       rexml (~> 3.0)
     hashie (5.0.0)
     http-accept (1.7.0)
-    http-cookie (1.0.8)
+    http-cookie (1.1.0)
       domain_name (~> 0.5)
     httpclient (2.9.0)
       mutex_m
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     iniparse (1.5.0)
-    inspec-core (5.22.95)
+    inspec-core (5.23.6)
       addressable (~> 2.4)
       chef-telemetry (~> 1.0, >= 1.0.8)
       cookstyle
@@ -244,11 +253,16 @@ GEM
       sslshake (~> 1.2)
       thor (>= 0.20, < 1.5.0)
       tomlrb (>= 1.2, < 2.1)
-      train-core (~> 3.12.13)
+      train-core (~> 3.13, >= 3.13.4)
       tty-prompt (~> 0.17)
       tty-table (~> 0.10)
+    io-console (0.8.1)
     iostruct (0.5.0)
     ipaddress (0.8.3)
+    irb (1.15.2)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
     jmespath (1.6.2)
     json (2.13.2)
     language_server-protocol (3.17.0.5)
@@ -268,9 +282,9 @@ GEM
     mime-types (3.7.0)
       logger
       mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2025.0812)
+    mime-types-data (3.2025.0924)
     minitar (1.0.2)
-    minitest (5.25.5)
+    minitest (5.26.0)
     mixlib-archive (1.1.7)
       mixlib-log
     mixlib-authentication (3.0.10)
@@ -323,6 +337,7 @@ GEM
       plist (~> 3.1)
       train-core
       wmi-lite (~> 1.0)
+    ostruct (0.6.3)
     parallel (1.27.0)
     parser (3.3.9.0)
       ast (~> 2.4.1)
@@ -337,19 +352,31 @@ GEM
       rainbow
       zhexdump (>= 0.0.2)
     plist (3.7.2)
-    prism (1.4.0)
+    pp (0.6.3)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.6.0)
     proxifier2 (1.1.0)
     pry (0.15.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
+    psych (5.2.6)
+      date
+      stringio
     public_suffix (6.0.2)
     racc (1.8.1)
-    rack (3.2.0)
+    rack (3.2.3)
     rackup (2.2.1)
       rack (>= 3)
     rainbow (3.1.1)
     rake (13.3.0)
-    regexp_parser (2.11.2)
+    rdoc (6.15.0)
+      erb
+      psych (>= 4.0.0)
+      tsort
+    regexp_parser (2.11.3)
+    reline (0.6.2)
+      io-console (~> 0.5)
     rest-client (2.1.0)
       http-accept (>= 1.7.0, < 2.0)
       http-cookie (>= 1.0.2, < 2.0)
@@ -357,11 +384,11 @@ GEM
       netrc (~> 0.8)
     retryable (3.0.5)
     rexml (3.4.1)
-    rspec (3.13.1)
+    rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.5)
+    rspec-core (3.13.6)
       rspec-support (~> 3.13.0)
     rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
@@ -369,11 +396,11 @@ GEM
     rspec-its (2.0.0)
       rspec-core (>= 3.13.0)
       rspec-expectations (>= 3.13.0)
-    rspec-mocks (3.13.5)
+    rspec-mocks (3.13.6)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.4)
-    rubocop (1.79.2)
+    rspec-support (3.13.6)
+    rubocop (1.81.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -381,10 +408,10 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.46.0, < 2.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.46.0)
+    rubocop-ast (1.47.1)
       parser (>= 3.3.7.2)
       prism (~> 1.4)
     ruby-progressbar (1.13.0)
@@ -394,27 +421,35 @@ GEM
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
+    securerandom (0.4.1)
     semverse (3.0.2)
     solve (4.0.4)
       molinillo (~> 0.6)
       semverse (>= 1.1, < 4.0)
     sslshake (1.3.1)
+    stringio (3.1.7)
     strings (0.2.1)
       strings-ansi (~> 0.2)
       unicode-display_width (>= 1.5, < 3.0)
       unicode_utils (~> 1.4)
     strings-ansi (0.2.0)
+    syslog (0.3.0)
+      logger
     syslog-logger (1.6.8)
-    test-kitchen (3.8.1)
+    test-kitchen (3.9.1)
       bcrypt_pbkdf (~> 1.0)
       chef-utils (>= 16.4.35)
+      csv (~> 3.3)
       ed25519 (~> 1.3)
+      irb (~> 1.15)
       license-acceptance (>= 1.0.11, < 3.0)
       mixlib-install (~> 3.6)
       mixlib-shellout (>= 1.2, < 4.0)
       net-scp (>= 1.1, < 5.0)
       net-ssh (>= 2.9, < 8.0)
       net-ssh-gateway (>= 1.2, < 3.0)
+      ostruct (~> 0.6)
+      syslog (~> 0.3)
       thor (>= 0.19, < 2.0)
       winrm (~> 2.0)
       winrm-elevated (~> 1.0)
@@ -426,9 +461,9 @@ GEM
     toml-rb (2.2.0)
       citrus (~> 3.0, > 3.0)
     tomlrb (1.3.0)
-    train-core (3.12.13)
+    train-core (3.13.4)
       addressable (~> 2.5)
-      ffi (!= 1.13.0)
+      ffi (~> 1.16.0)
       json (>= 1.8, < 3.0)
       mixlib-shellout (>= 2.0, < 4.0)
       net-scp (>= 1.2, < 5.0)
@@ -441,6 +476,7 @@ GEM
       chef-winrm (~> 2.3.12)
       chef-winrm-elevated (~> 1.2.5)
       chef-winrm-fs (~> 1.3.7)
+    tsort (0.2.0)
     tty-box (0.7.0)
       pastel (~> 0.8)
       strings (~> 0.2.0)
@@ -502,7 +538,7 @@ DEPENDENCIES
   archive-tar-minitar
   artifactory
   berkshelf (~> 8.0.22)
-  chef (~> 18.8.11)
+  chef (~> 18.8.46)
   license_scout!
   omnibus!
   omnibus-software!
diff --git a/omnibus/files/server-ctl-cookbooks/infra-server/Gemfile b/omnibus/files/server-ctl-cookbooks/infra-server/Gemfile
index 43036e84ab..44104464fb 100644
--- a/omnibus/files/server-ctl-cookbooks/infra-server/Gemfile
+++ b/omnibus/files/server-ctl-cookbooks/infra-server/Gemfile
@@ -3,4 +3,4 @@ source 'https://rubygems.org'
 gem 'cookstyle'
 gem 'chefspec'
 gem 'veil'
-gem 'chef', '~> 18.8.11' # Updated for chef 18.8.11 upgrade
+gem 'chef', '~> 18.8.46' # Updated for chef 18.8.46 upgrade
diff --git a/omnibus_overrides.rb b/omnibus_overrides.rb
index 8f720f741d..fb6d94c0e5 100644
--- a/omnibus_overrides.rb
+++ b/omnibus_overrides.rb
@@ -4,7 +4,7 @@
 #
 override :erlang, version: "26.2.5.14"
 override :'omnibus-ctl', version: "main"
-override :chef, version: "v18.6.1"
+override :chef, version: "v18.8.46"
 override :ohai, version: "v16.17.0"
 override :ruby, version: "3.1.7"
 override :perl, version: "5.34.0"
diff --git a/scripts/bk_tests/chef_zero-Gemfile b/scripts/bk_tests/chef_zero-Gemfile
index 7cfb26f19a..31a32d6b58 100644
--- a/scripts/bk_tests/chef_zero-Gemfile
+++ b/scripts/bk_tests/chef_zero-Gemfile
@@ -7,7 +7,7 @@ gem 'pry-byebug'
 gem 'pry-stack_explorer'
 gem 'rake'
 
-gem 'chef',  "~> 18.8.11"
+gem 'chef',  "~> 18.8.46"
 # For "rake chef_zero_spec"
 gem 'chef-zero', github: 'chef/chef-zero', tag: 'v15.0.21'
 
diff --git a/src/chef-server-ctl/Gemfile b/src/chef-server-ctl/Gemfile
index c327a0afdd..d0fd4e15bc 100644
--- a/src/chef-server-ctl/Gemfile
+++ b/src/chef-server-ctl/Gemfile
@@ -2,7 +2,7 @@ source "https://rubygems.org"
 
 gemspec
 
-gem "chef", "~> 18.8.11"
+gem "chef", "~> 18.8.46"
 gem "toml" # for habitat-land
 
 gem "knife","~> 18.8.13"
diff --git a/src/chef-server-ctl/Gemfile.lock b/src/chef-server-ctl/Gemfile.lock
index d3e586e1c4..d56b8c8997 100644
--- a/src/chef-server-ctl/Gemfile.lock
+++ b/src/chef-server-ctl/Gemfile.lock
@@ -3,12 +3,13 @@ PATH
   specs:
     chef-server-ctl (1.1.0)
       appbundler
-      chef (~> 18.8.11)
+      chef (~> 18.8.46)
       chef_backup
       chef_fixie (>= 1.0.3)
       ffi-yajl (>= 1.2.0)
       highline (>= 1.6.9, < 3.0)
       knife
+      knife-ec-backup
       license-acceptance
       mixlib-install
       mixlib-log
@@ -34,8 +35,8 @@ GEM
       mixlib-shellout (>= 2.0, < 4.0)
     ast (2.4.3)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1148.0)
-    aws-sdk-core (3.229.0)
+    aws-partitions (1.1174.0)
+    aws-sdk-core (3.234.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -43,15 +44,15 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.110.0)
-      aws-sdk-core (~> 3, >= 3.228.0)
+    aws-sdk-kms (1.115.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.196.1)
-      aws-sdk-core (~> 3, >= 3.228.0)
+    aws-sdk-s3 (1.201.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
-    aws-sdk-secretsmanager (1.119.0)
-      aws-sdk-core (~> 3, >= 3.228.0)
+    aws-sdk-secretsmanager (1.121.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
@@ -75,13 +76,13 @@ GEM
       thor (>= 0.20, < 1.3.0)
     bigdecimal (3.2.2)
     builder (3.3.0)
-    chef (18.8.11)
-      activesupport (>= 4.2.7.1, <= 7.1.3.2)
+    chef (18.8.46)
+      activesupport (>= 4.2.7.1, <= 7.1.5.2)
       addressable
       aws-sdk-s3 (~> 1.91)
       aws-sdk-secretsmanager (~> 1.46)
-      chef-config (= 18.8.11)
-      chef-utils (= 18.8.11)
+      chef-config (= 18.8.46)
+      chef-utils (= 18.8.46)
       chef-vault
       chef-zero (>= 15.0.21)
       corefoundation (~> 0.3.4)
@@ -104,19 +105,19 @@ GEM
       plist (~> 3.2)
       proxifier2 (~> 1.1)
       syslog-logger (~> 1.6)
-      train-core (~> 3.10, <= 3.12.13)
+      train-core (~> 3.13, >= 3.13.4)
       train-rest (>= 0.4.1)
       train-winrm (~> 0.2.17)
       unf_ext (~> 0.0.8.2)
       uri (~> 1.0.3)
       uuidtools (>= 2.1.5, < 3.0)
       vault (~> 0.18.2)
-    chef-bin (18.8.11)
-      chef (= 18.8.11)
+    chef-bin (18.8.46)
+      chef (= 18.8.46)
     chef-cleanroom (1.0.5)
-    chef-config (18.8.11)
+    chef-config (18.8.46)
       addressable
-      chef-utils (= 18.8.11)
+      chef-utils (= 18.8.46)
       fuzzyurl
       mixlib-config (>= 2.2.12, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
@@ -134,7 +135,7 @@ GEM
     chef-telemetry (1.1.1)
       chef-config
       concurrent-ruby (~> 1.0)
-    chef-utils (18.8.11)
+    chef-utils (18.8.46)
       concurrent-ruby
     chef-vault (4.1.23)
     chef-winrm (2.3.12)
@@ -198,7 +199,7 @@ GEM
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-follow_redirects (0.3.0)
+    faraday-follow_redirects (0.4.0)
       faraday (>= 1, < 3)
     faraday-http-cache (2.5.1)
       faraday (>= 0.8)
@@ -222,7 +223,7 @@ GEM
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     iniparse (1.5.0)
-    inspec-core (5.22.95)
+    inspec-core (5.23.6)
       addressable (~> 2.4)
       chef-telemetry (~> 1.0, >= 1.0.8)
       cookstyle
@@ -243,7 +244,7 @@ GEM
       sslshake (~> 1.2)
       thor (>= 0.20, < 1.5.0)
       tomlrb (>= 1.2, < 2.1)
-      train-core (~> 3.12.13)
+      train-core (~> 3.13, >= 3.13.4)
       tty-prompt (~> 0.17)
       tty-table (~> 0.10)
     ipaddress (0.8.3)
@@ -446,9 +447,9 @@ GEM
     toml (0.3.0)
       parslet (>= 1.8.0, < 3.0.0)
     tomlrb (1.3.0)
-    train-core (3.12.13)
+    train-core (3.13.4)
       addressable (~> 2.5)
-      ffi (!= 1.13.0)
+      ffi (~> 1.16.0)
       json (>= 1.8, < 3.0)
       mixlib-shellout (>= 2.0, < 4.0)
       net-scp (>= 1.2, < 5.0)
@@ -499,12 +500,13 @@ GEM
 
 PLATFORMS
   arm64-darwin-21
+  arm64-darwin-23
   arm64-darwin-24
   x86_64-linux
 
 DEPENDENCIES
   berkshelf (~> 8.0.22)
-  chef (~> 18.8.11)
+  chef (~> 18.8.46)
   chef-server-ctl!
   chefstyle
   knife (~> 18.8.13)
diff --git a/src/chef-server-ctl/chef-server-ctl.gemspec b/src/chef-server-ctl/chef-server-ctl.gemspec
index 16717ab6f8..73b305b99d 100644
--- a/src/chef-server-ctl/chef-server-ctl.gemspec
+++ b/src/chef-server-ctl/chef-server-ctl.gemspec
@@ -40,7 +40,7 @@ Gem::Specification.new do |spec|
 
   spec.add_runtime_dependency "appbundler"
 
-  spec.add_runtime_dependency "chef", "~> 18.8.11"
+  spec.add_runtime_dependency "chef", "~> 18.8.46"
   spec.add_runtime_dependency "knife"
 
   # tools we bundle in the chef-server install and include here so we can have a single Gemfile.lock
diff --git a/src/chef-server-ctl/habitat/plan.sh b/src/chef-server-ctl/habitat/plan.sh
index 6541b0788c..0050d34ae7 100644
--- a/src/chef-server-ctl/habitat/plan.sh
+++ b/src/chef-server-ctl/habitat/plan.sh
@@ -91,7 +91,7 @@ do_install() {
 
   cat > Gemfile << EOF
 source 'https://rubygems.org'
-gem 'chef', '~> 18.8.11'
+gem 'chef', '~> 18.8.46'
 gem 'knife', '~> 18.8.13'
 EOF
 
diff --git a/src/oc-id/Gemfile b/src/oc-id/Gemfile
index 2e790cbc58..e7e79f0eca 100644
--- a/src/oc-id/Gemfile
+++ b/src/oc-id/Gemfile
@@ -2,8 +2,8 @@ source 'https://rubygems.org'
 git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 
 # Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
-gem 'rails', '~> 7.1.0'
-gem 'chef', '~> 18.8.11'
+gem 'rails', '7.1.5.2'
+gem 'chef', '~> 18.8.46'
 gem 'jbuilder', '~> 2.11'
 gem 'jquery-rails'
 gem 'jwt' # For Zendesk SSO
diff --git a/src/oc-id/Gemfile.lock b/src/oc-id/Gemfile.lock
index f2fb30c308..6f7270f6ae 100644
--- a/src/oc-id/Gemfile.lock
+++ b/src/oc-id/Gemfile.lock
@@ -28,35 +28,35 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actioncable (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activejob (= 7.1.3.2)
-      activerecord (= 7.1.3.2)
-      activestorage (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actionmailbox (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activejob (= 7.1.5.2)
+      activerecord (= 7.1.5.2)
+      activestorage (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       mail (>= 2.7.1)
       net-imap
       net-pop
       net-smtp
-    actionmailer (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      actionview (= 7.1.3.2)
-      activejob (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actionmailer (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      actionview (= 7.1.5.2)
+      activejob (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       mail (~> 2.5, >= 2.5.4)
       net-imap
       net-pop
       net-smtp
       rails-dom-testing (~> 2.2)
-    actionpack (7.1.3.2)
-      actionview (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actionpack (7.1.5.2)
+      actionview (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       nokogiri (>= 1.8.5)
       racc
       rack (>= 2.2.4)
@@ -64,50 +64,53 @@ GEM
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    actiontext (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activerecord (= 7.1.3.2)
-      activestorage (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actiontext (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activerecord (= 7.1.5.2)
+      activestorage (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.1.3.2)
-      activesupport (= 7.1.3.2)
+    actionview (7.1.5.2)
+      activesupport (= 7.1.5.2)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.1.3.2)
-      activesupport (= 7.1.3.2)
+    activejob (7.1.5.2)
+      activesupport (= 7.1.5.2)
       globalid (>= 0.3.6)
-    activemodel (7.1.3.2)
-      activesupport (= 7.1.3.2)
-    activerecord (7.1.3.2)
-      activemodel (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    activemodel (7.1.5.2)
+      activesupport (= 7.1.5.2)
+    activerecord (7.1.5.2)
+      activemodel (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       timeout (>= 0.4.0)
-    activestorage (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activejob (= 7.1.3.2)
-      activerecord (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    activestorage (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activejob (= 7.1.5.2)
+      activerecord (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       marcel (~> 1.0)
-    activesupport (7.1.3.2)
+    activesupport (7.1.5.2)
       base64
+      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
       minitest (>= 5.1)
       mutex_m
+      securerandom (>= 0.3)
       tzinfo (~> 2.0)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
     ast (2.4.3)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1147.0)
-    aws-sdk-core (3.229.0)
+    aws-partitions (1.1174.0)
+    aws-sdk-core (3.233.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -115,20 +118,21 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.110.0)
-      aws-sdk-core (~> 3, >= 3.228.0)
+    aws-sdk-kms (1.114.0)
+      aws-sdk-core (~> 3, >= 3.231.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.196.1)
-      aws-sdk-core (~> 3, >= 3.228.0)
+    aws-sdk-s3 (1.200.0)
+      aws-sdk-core (~> 3, >= 3.231.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
-    aws-sdk-secretsmanager (1.119.0)
-      aws-sdk-core (~> 3, >= 3.228.0)
+    aws-sdk-secretsmanager (1.120.0)
+      aws-sdk-core (~> 3, >= 3.231.0)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.3.0)
     bcrypt (3.1.20)
+    benchmark (0.4.1)
     better_errors (2.10.1)
       erubi (>= 1.0.0)
       rack (>= 0.9.0)
@@ -148,13 +152,13 @@ GEM
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
     cgi (0.5.0)
-    chef (18.8.11)
-      activesupport (>= 4.2.7.1, <= 7.1.3.2)
+    chef (18.8.46)
+      activesupport (>= 4.2.7.1, <= 7.1.5.2)
       addressable
       aws-sdk-s3 (~> 1.91)
       aws-sdk-secretsmanager (~> 1.46)
-      chef-config (= 18.8.11)
-      chef-utils (= 18.8.11)
+      chef-config (= 18.8.46)
+      chef-utils (= 18.8.46)
       chef-vault
       chef-zero (>= 15.0.21)
       corefoundation (~> 0.3.4)
@@ -177,16 +181,16 @@ GEM
       plist (~> 3.2)
       proxifier2 (~> 1.1)
       syslog-logger (~> 1.6)
-      train-core (~> 3.10, <= 3.12.13)
+      train-core (~> 3.13, >= 3.13.4)
       train-rest (>= 0.4.1)
       train-winrm (~> 0.2.17)
       unf_ext (~> 0.0.8.2)
       uri (~> 1.0.3)
       uuidtools (>= 2.1.5, < 3.0)
       vault (~> 0.18.2)
-    chef-config (18.8.11)
+    chef-config (18.8.46)
       addressable
-      chef-utils (= 18.8.11)
+      chef-utils (= 18.8.46)
       fuzzyurl
       mixlib-config (>= 2.2.12, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
@@ -197,9 +201,10 @@ GEM
     chef-telemetry (1.1.1)
       chef-config
       concurrent-ruby (~> 1.0)
-    chef-utils (18.8.11)
+    chef-utils (18.8.46)
       concurrent-ruby
-    chef-vault (4.1.23)
+    chef-vault (4.2.5)
+      syslog (~> 0.3)
     chef-winrm (2.3.12)
       builder (>= 2.1.2)
       chef-gyoku (~> 1.4.0, <= 1.4.5)
@@ -243,8 +248,8 @@ GEM
       deep_merge (~> 1.2, >= 1.2.1)
       dry-validation (~> 1.0, >= 1.0.0)
     connection_pool (2.5.3)
-    cookstyle (8.4.0)
-      rubocop (= 1.79.2)
+    cookstyle (8.5.0)
+      rubocop (= 1.81.0)
     corefoundation (0.3.13)
       ffi (>= 1.15.0)
     crass (1.0.6)
@@ -300,14 +305,14 @@ GEM
     execjs (2.10.0)
     factory_bot (6.5.5)
       activesupport (>= 6.1.0)
-    factory_bot_rails (6.5.0)
+    factory_bot_rails (6.5.1)
       factory_bot (~> 6.5)
       railties (>= 6.1.0)
-    faraday (2.13.4)
+    faraday (2.14.0)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-follow_redirects (0.3.0)
+    faraday-follow_redirects (0.4.0)
       faraday (>= 1, < 3)
     faraday-net_http (3.4.1)
       net-http (>= 0.5.0)
@@ -317,7 +322,7 @@ GEM
     ffi-yajl (2.6.0)
       libyajl2 (>= 1.2)
     fuzzyurl (0.9.0)
-    globalid (1.2.1)
+    globalid (1.3.0)
       activesupport (>= 6.1)
     gssapi (1.3.1)
       ffi (>= 1.0.1)
@@ -327,14 +332,14 @@ GEM
       tilt
     hashie (5.0.0)
     http-accept (1.7.0)
-    http-cookie (1.0.8)
+    http-cookie (1.1.0)
       domain_name (~> 0.5)
     httpclient (2.9.0)
       mutex_m
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     iniparse (1.5.0)
-    inspec-core (5.22.95)
+    inspec-core (5.23.6)
       addressable (~> 2.4)
       chef-telemetry (~> 1.0, >= 1.0.8)
       cookstyle
@@ -355,7 +360,7 @@ GEM
       sslshake (~> 1.2)
       thor (>= 0.20, < 1.5.0)
       tomlrb (>= 1.2, < 2.1)
-      train-core (~> 3.12.13)
+      train-core (~> 3.13, >= 3.13.4)
       tty-prompt (~> 0.17)
       tty-table (~> 0.10)
     io-console (0.8.1)
@@ -407,13 +412,13 @@ GEM
       skinny (>= 0.1.2)
       sqlite3-ruby
       thin
-    marcel (1.0.4)
+    marcel (1.1.0)
     matrix (0.4.3)
     method_source (1.1.0)
     mime-types (3.7.0)
       logger
       mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2025.0812)
+    mime-types-data (3.2025.0924)
     mini_mime (1.1.5)
     minitest (5.25.5)
     mixlib-archive (1.1.7)
@@ -488,7 +493,7 @@ GEM
     pp (0.6.2)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.4.0)
+    prism (1.6.0)
     proxifier2 (1.1.0)
     pry (0.15.2)
       coderay (~> 1.1)
@@ -513,20 +518,20 @@ GEM
       rack (>= 1.3)
     rackup (2.2.1)
       rack (>= 3)
-    rails (7.1.3.2)
-      actioncable (= 7.1.3.2)
-      actionmailbox (= 7.1.3.2)
-      actionmailer (= 7.1.3.2)
-      actionpack (= 7.1.3.2)
-      actiontext (= 7.1.3.2)
-      actionview (= 7.1.3.2)
-      activejob (= 7.1.3.2)
-      activemodel (= 7.1.3.2)
-      activerecord (= 7.1.3.2)
-      activestorage (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    rails (7.1.5.2)
+      actioncable (= 7.1.5.2)
+      actionmailbox (= 7.1.5.2)
+      actionmailer (= 7.1.5.2)
+      actionpack (= 7.1.5.2)
+      actiontext (= 7.1.5.2)
+      actionview (= 7.1.5.2)
+      activejob (= 7.1.5.2)
+      activemodel (= 7.1.5.2)
+      activerecord (= 7.1.5.2)
+      activestorage (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       bundler (>= 1.15.0)
-      railties (= 7.1.3.2)
+      railties (= 7.1.5.2)
     rails-controller-testing (1.0.5)
       actionpack (>= 5.0.1.rc1)
       actionview (>= 5.0.1.rc1)
@@ -538,9 +543,9 @@ GEM
     rails-html-sanitizer (1.6.2)
       loofah (~> 2.21)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.1.3.2)
-      actionpack (= 7.1.3.2)
-      activesupport (= 7.1.3.2)
+    railties (7.1.5.2)
+      actionpack (= 7.1.5.2)
+      activesupport (= 7.1.5.2)
       irb
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -556,9 +561,9 @@ GEM
     regexp_parser (2.11.2)
     reline (0.6.2)
       io-console (~> 0.5)
-    responders (3.1.1)
-      actionpack (>= 5.2)
-      railties (>= 5.2)
+    responders (3.2.0)
+      actionpack (>= 7.0)
+      railties (>= 7.0)
     rest-client (2.1.0)
       http-accept (>= 1.7.0, < 2.0)
       http-cookie (>= 1.0.2, < 2.0)
@@ -566,7 +571,7 @@ GEM
       netrc (~> 0.8)
     rexml (3.4.1)
     rouge (4.6.0)
-    rspec (3.13.1)
+    rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
@@ -590,7 +595,7 @@ GEM
       rspec-mocks (~> 3.13)
       rspec-support (~> 3.13)
     rspec-support (3.13.4)
-    rubocop (1.79.2)
+    rubocop (1.81.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -598,10 +603,10 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.46.0, < 2.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.46.0)
+    rubocop-ast (1.47.1)
       parser (>= 3.3.7.2)
       prism (~> 1.4)
     ruby-progressbar (1.13.0)
@@ -621,6 +626,7 @@ GEM
       tilt
     sdoc (2.6.1)
       rdoc (>= 5.0)
+    securerandom (0.4.1)
     selenium-webdriver (4.7.1)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
@@ -658,6 +664,8 @@ GEM
       unicode-display_width (>= 1.5, < 3.0)
       unicode_utils (~> 1.4)
     strings-ansi (0.2.0)
+    syslog (0.3.0)
+      logger
     syslog-logger (1.6.8)
     temple (0.10.4)
     thin (2.0.1)
@@ -672,9 +680,9 @@ GEM
     timecop (0.9.10)
     timeout (0.4.3)
     tomlrb (1.3.0)
-    train-core (3.12.13)
+    train-core (3.13.4)
       addressable (~> 2.5)
-      ffi (!= 1.13.0)
+      ffi (~> 1.16.0)
       json (>= 1.8, < 3.0)
       mixlib-shellout (>= 2.0, < 4.0)
       net-scp (>= 1.2, < 5.0)
@@ -738,6 +746,7 @@ GEM
 
 PLATFORMS
   arm64-darwin-21
+  arm64-darwin-23
   arm64-darwin-24
   x86_64-linux
 
@@ -746,7 +755,7 @@ DEPENDENCIES
   bigdecimal (= 3.1.3)
   binding_of_caller
   capybara (~> 3.39)
-  chef (~> 18.8.11)
+  chef (~> 18.8.46)
   coffee-rails (~> 5.0)
   config (~> 4.1)
   doorkeeper (~> 5.0)
@@ -761,7 +770,7 @@ DEPENDENCIES
   pg (>= 0.18, < 1.6)
   pry-byebug
   rack (> 3.0)
-  rails (~> 7.1.0)
+  rails (= 7.1.5.2)
   rails-controller-testing
   rb-readline (~> 0.5.2)
   responders (~> 3.0, >= 3.0.1)
@@ -781,4 +790,4 @@ DEPENDENCIES
   veil (~> 0.3.11)!
 
 BUNDLED WITH
-   2.3.27
\ No newline at end of file
+   2.3.27
diff --git a/src/oc-id/habitat/plan.sh b/src/oc-id/habitat/plan.sh
index 99795b1eac..346b5a9a74 100644
--- a/src/oc-id/habitat/plan.sh
+++ b/src/oc-id/habitat/plan.sh
@@ -131,4 +131,4 @@ do_install() {
 # needed due to libffi Bad value error
 do_strip() {
   return 0
-}
+}
\ No newline at end of file