diff --git a/images/db/Dockerfile b/images/db/Dockerfile
index ed35e853..8de2288e 100644
--- a/images/db/Dockerfile
+++ b/images/db/Dockerfile
@@ -1,7 +1,6 @@
-# Stage 1: Compilar el plugin para PostgreSQL 17
 FROM postgres:17 AS builder
 
-# Instalar dependencias de compilación
+# Install build dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     build-essential \
@@ -18,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && update-ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Clonar y compilar el plugin osmdbt para PostgreSQL 17
+# Clone and build osmdbt plugin for PostgreSQL 17
 RUN git clone https://github.com/openstreetmap/osmdbt.git /tmp/osmdbt && \
     cd /tmp/osmdbt && \
     git checkout v0.9 && \
@@ -29,6 +28,15 @@ RUN git clone https://github.com/openstreetmap/osmdbt.git /tmp/osmdbt && \
 
 FROM postgres:17
 
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    postgresql-17-postgis-3 \
+    postgresql-17-postgis-3-scripts \
+    && rm -rf /var/lib/apt/lists/*
+
+# Auto-create required extensions on fresh initdb
+COPY ./scripts/init-extensions.sh /docker-entrypoint-initdb.d/10-extensions.sh
+RUN chmod +x /docker-entrypoint-initdb.d/10-extensions.sh
+
 COPY --from=builder /tmp/osmdbt/postgresql-plugin/build/osm-logical.so /usr/lib/postgresql/17/lib/osm-logical.so
 
 RUN ln -s /usr/lib/postgresql/17/lib/osm-logical.so /usr/lib/postgresql/17/lib/osm_logical.so
diff --git a/images/db/scripts/init-extensions.sh b/images/db/scripts/init-extensions.sh
new file mode 100755
index 00000000..9c780af7
--- /dev/null
+++ b/images/db/scripts/init-extensions.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+
+psql --username="$POSTGRES_USER" --dbname="$POSTGRES_DB" -v ON_ERROR_STOP=1 <<-'EOSQL'
+    CREATE EXTENSION IF NOT EXISTS postgis;
+    CREATE EXTENSION IF NOT EXISTS hstore;
+    CREATE EXTENSION IF NOT EXISTS btree_gist;
+EOSQL
diff --git a/images/web/Dockerfile b/images/web/Dockerfile
index fb352fd6..a429559f 100644
--- a/images/web/Dockerfile
+++ b/images/web/Dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.3-slim AS builder
+FROM ruby:3.4-slim AS builder
 
 ENV DEBIAN_FRONTEND=noninteractive \
     workdir=/var/www \
@@ -14,9 +14,9 @@ WORKDIR $workdir
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     git curl gnupg build-essential \
-    libarchive-dev zlib1g-dev libcurl4-openssl-dev \
+    libarchive-dev zlib1g-dev libcurl4-openssl-dev libgd-dev \
     apache2 apache2-dev libapache2-mod-fcgid libapr1-dev libaprutil1-dev \
-    postgresql-client libpq-dev libxml2-dev libyaml-dev libgd-dev \
+    postgresql-client libpq-dev libxml2-dev libyaml-dev \
     pngcrush optipng advancecomp pngquant jhead jpegoptim gifsicle libjpeg-progs unzip\
     && curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
     && apt-get install -y nodejs \
@@ -31,7 +31,7 @@ RUN rm -rf $workdir/* && curl -fsSL $OHM_WEBSITE_URL -o /tmp/ohm-website.zip &&
     mv /tmp/ohm-website-$OPENHISTORICALMAP_WEBSITE_GITSHA/* $workdir && \
     rm -rf /tmp/*
 
-RUN gem install bundler && \
+RUN gem install bundler -v 4.0.11 --no-document && \
     bundle install && \
     yarn install && \
     bundle exec rake yarn:install
@@ -77,7 +77,7 @@ RUN git clone https://github.com/OpenHistoricalMap/leaflet-ohm-timeslider-v2.git
     cp leaflet-ohm-timeslider.* $workdir/app/assets/stylesheets/ && \
     cp assets/* $workdir/app/assets/images/
 
-FROM ruby:3.3-slim
+FROM ruby:3.4-slim
 
 ENV DEBIAN_FRONTEND=noninteractive \
     workdir=/var/www \
@@ -116,6 +116,7 @@ RUN BUILD_DEPS=" \
     gifsicle \
     postgresql-client \
     curl \
+    git \
     libvips \
     nodejs \
     \
@@ -123,7 +124,7 @@ RUN BUILD_DEPS=" \
     \
     # Install Passenger as a gem and compile the Apache module
     \
-    && gem install passenger --no-document \
+    && gem install passenger -v 6.1.3 --no-document \
     && yes | passenger-install-apache2-module --auto --languages ruby \
     && passenger-config validate-install --auto \
     \
@@ -152,6 +153,10 @@ RUN a2enmod headers setenvif proxy proxy_http proxy_fcgi fcgid rewrite lbmethod_
     echo "ServerName localhost" >> /etc/apache2/apache2.conf && \
     apache2ctl configtest
 
+# Install bundler matching ohm-website Gemfile.lock to avoid Passenger preloader Gem::LoadError.
+RUN gem install bundler -v 4.0.11 --no-document
+
+
 RUN echo '#!/bin/bash\nexec /usr/local/bin/ruby --yjit --yjit-exec-mem-size=64 "$@"' > /usr/local/bin/ruby_yjit && \
     chmod +x /usr/local/bin/ruby_yjit
     
diff --git a/images/web/config/production.conf b/images/web/config/production.conf
index 87be1d2e..bb1260b4 100644
--- a/images/web/config/production.conf
+++ b/images/web/config/production.conf
@@ -4,6 +4,9 @@
     DocumentRoot /var/www/public
     PassengerAppEnv production
     PassengerRuby /usr/local/bin/ruby
+    # Load Bundler before Ruby preloads default gems so Gemfile.lock pins
+    # (e.g. stringio 3.2.0) win over Ruby-bundled defaults like 3.1.2.
+    PassengerPreloadBundler on
     RewriteEngine On
     
     # Redirect to HTTPS