diff --git a/.github/actions/ci/action.yml b/.github/actions/ci/action.yml
index cef240b..759214c 100644
--- a/.github/actions/ci/action.yml
+++ b/.github/actions/ci/action.yml
@@ -11,6 +11,7 @@ runs:
     - uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0
       with:
         ruby-version: ${{ inputs.ruby-version }}
+        bundler: 4.0.19
 
     - name: Install dependencies
       shell: bash
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3d7a5aa..6d6d020 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,6 +46,7 @@ jobs:
       - uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0
         with:
           ruby-version: 3.4
+          bundler: 4.0.19
 
       - name: Install dependencies
         run: bundle install
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f04f0d3..0cb6d8d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -16,6 +16,8 @@ We encourage pull requests and other contributions from the community. Before su
 
 This SDK is built with [Bundler](https://bundler.io/). To install Bundler, run `gem install bundler`. You might need `sudo` to execute the command successfully.
 
+The `Gemfile` declares a [cooldown](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html), so dependencies only resolve to versions that have been published for at least seven days. `launchdarkly-server-sdk` is exempt, because we publish it ourselves and generally want to build against a release immediately. Cooldown requires Bundler 4.0.13 or later; older versions ignore the setting and resolve to the newest matching version. Pass `--cooldown 0` to reach a version inside the window, for instance when a security fix has just been released.
+
 To install the runtime dependencies:
 
 ```
diff --git a/Gemfile b/Gemfile
index d3276be..13bc9af 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-source "https://rubygems.org"
+source "https://rubygems.org", cooldown: 7
 
 # Specify your gem's dependencies in launchdarkly-openfeature-server-sdk.gemspec
 gemspec
@@ -13,3 +13,9 @@ gem "rubocop", "~> 1.76"
 gem "rubocop-performance", "~> 1.25"
 gem "rubocop-rake", "~> 0.6"
 gem "rubocop-rspec", "~> 3.9"
+
+# Cooldown is configured per source, so exempting our own SDK from it requires a
+# second remote for the same registry.
+source "https://index.rubygems.org", cooldown: 0 do
+  gem "launchdarkly-server-sdk"
+end