diff --git a/.rubocop.yml b/.rubocop.yml
index ee30cc915..eb1b2b8d4 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -2,10 +2,10 @@ AllCops:
   Exclude:
     - 'vendor/**/*'
     - 'scripts/vendor/**/*'
-  TargetRubyVersion: 2.2
-Metrics/BlockLength:
-  # FIXME: Remove when upstream PR is released:
-  # https://github.com/alphagov/govuk-lint/pull/87
-  Enabled: true
-  Exclude:
-    - "**/spec/**/*"
+  TargetRubyVersion: 2.5
+Performance/HashEachMethods:
+  Enabled: false
+Performance/RegexpMatch:
+  Enabled: false
+Style/NumericPredicate:
+  Enabled: false
diff --git a/.ruby-version b/.ruby-version
new file mode 100644
index 000000000..73462a5a1
--- /dev/null
+++ b/.ruby-version
@@ -0,0 +1 @@
+2.5.1
diff --git a/.travis.yml b/.travis.yml
index d9fcc50cc..0dc0368da 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,7 +1,7 @@
 dist: trusty
 sudo: false
 rvm:
-  - 2.2.6
+  - 2.5
 env:
   global:
     - TF_VERSION="0.11.1"
diff --git a/Gemfile b/Gemfile
index 8bd9f0643..2e14c8726 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,7 +1,7 @@
 source "https://rubygems.org"
 
 gem 'github_merge_sign', '1.0.0'
-gem 'govuk-lint', "~> 3.3.0"
+gem 'govuk-lint', "~> 3.8.0"
 gem 'json-minify', '~> 0.0.2'
 gem 'rspec', '~> 3.3'
 gem 'webmock', "~> 1.24"
diff --git a/Gemfile.lock b/Gemfile.lock
index f22888260..74d88f73b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -2,29 +2,28 @@ GEM
   remote: https://rubygems.org/
   specs:
     addressable (2.4.0)
-    ast (2.3.0)
+    ast (2.4.0)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
     diff-lcs (1.2.5)
-    ffi (1.9.18)
+    ffi (1.9.23)
     github_merge_sign (1.0.0)
-    govuk-lint (3.3.0)
-      rubocop (~> 0.49.0)
-      rubocop-rspec (~> 1.16.0)
+    govuk-lint (3.8.0)
+      rubocop (~> 0.52.0)
+      rubocop-rspec (~> 1.19.0)
       scss_lint
     hashdiff (0.3.0)
     json (2.0.2)
     json-minify (0.0.2)
       json (> 0)
     net-ssh (2.9.2)
-    parallel (1.12.0)
-    parser (2.4.0.2)
-      ast (~> 2.3)
+    parallel (1.12.1)
+    parser (2.5.1.0)
+      ast (~> 2.4.0)
     powerpack (0.1.1)
-    rainbow (2.2.2)
-      rake
-    rake (12.3.0)
-    rb-fsevent (0.10.2)
+    rainbow (3.0.0)
+    rake (12.3.1)
+    rb-fsevent (0.10.3)
     rb-inotify (0.9.10)
       ffi (>= 0.5.0, < 2)
     rspec (3.5.0)
@@ -40,26 +39,26 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.5.0)
     rspec-support (3.5.0)
-    rubocop (0.49.1)
+    rubocop (0.52.1)
       parallel (~> 1.10)
-      parser (>= 2.3.3.1, < 3.0)
+      parser (>= 2.4.0.2, < 3.0)
       powerpack (~> 0.1)
-      rainbow (>= 1.99.1, < 3.0)
+      rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (~> 1.0, >= 1.0.1)
-    rubocop-rspec (1.16.0)
-      rubocop (>= 0.49.0)
+    rubocop-rspec (1.19.0)
+      rubocop (>= 0.51.0)
     ruby-progressbar (1.9.0)
     safe_yaml (1.0.4)
-    sass (3.5.3)
+    sass (3.5.6)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
-    scss_lint (0.56.0)
+    scss_lint (0.57.0)
       rake (>= 0.9, < 13)
-      sass (~> 3.5.3)
-    unicode-display_width (1.3.0)
+      sass (~> 3.5.5)
+    unicode-display_width (1.3.2)
     webmock (1.24.6)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
@@ -70,11 +69,11 @@ PLATFORMS
 
 DEPENDENCIES
   github_merge_sign (= 1.0.0)
-  govuk-lint (~> 3.3.0)
+  govuk-lint (~> 3.8.0)
   json-minify (~> 0.0.2)
   net-ssh (>= 2.9.2)
   rspec (~> 3.3)
   webmock (~> 1.24)
 
 BUNDLED WITH
-   1.16.0
+   1.16.2
diff --git a/concourse/pipelines/create-bosh-concourse.yml b/concourse/pipelines/create-bosh-concourse.yml
index f8ba2ddd3..98a1b82bf 100644
--- a/concourse/pipelines/create-bosh-concourse.yml
+++ b/concourse/pipelines/create-bosh-concourse.yml
@@ -342,7 +342,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/self-update-pipelines
-              tag: 895cf6752c8ec64af05a3a735186b90acd3db65a
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: paas-bootstrap
           params:
@@ -556,7 +556,7 @@ jobs:
               type: docker-image
               source:
                 repository: ruby
-                tag: 2.2-slim
+                tag: 2.5-slim
             inputs:
               - name: paas-bootstrap
               - name: bosh-secrets
@@ -670,7 +670,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: 2.2-slim
+              tag: 2.5-slim
           inputs:
           - name: paas-bootstrap
           - name: concourse-secrets
@@ -718,7 +718,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: 2.2-slim
+              tag: 2.5-slim
           inputs:
             - name: paas-bootstrap
             - name: vpc-tfstate
@@ -814,7 +814,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: 2.2-slim
+              tag: 2.5-slim
           inputs:
             - name: paas-bootstrap
             - name: vpc-tfstate
@@ -1010,7 +1010,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: bosh-manifest
             - name: bosh-init-state
@@ -1044,7 +1044,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: paas-bootstrap
             - name: bosh-secrets
@@ -1088,7 +1088,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: 2.2-slim
+              tag: 2.5-slim
           inputs:
           - name: paas-bootstrap
           - name: vpc-tfstate
@@ -1290,7 +1290,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: 2.2-slim
+              tag: 2.5-slim
           inputs:
           - name: paas-bootstrap
           - name: concourse-tfstate
@@ -1402,7 +1402,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: bosh-secrets
             - name: paas-bootstrap
@@ -1433,7 +1433,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
           - name: concourse-manifest
           - name: bosh-secrets
@@ -1459,7 +1459,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/self-update-pipelines
-              tag: 895cf6752c8ec64af05a3a735186b90acd3db65a
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: paas-bootstrap
             - name: concourse-manifest
@@ -1506,7 +1506,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
           - name: paas-bootstrap
           - name: bosh-secrets
@@ -1533,7 +1533,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/self-update-pipelines
-              tag: 895cf6752c8ec64af05a3a735186b90acd3db65a
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: paas-bootstrap
           params:
@@ -1574,7 +1574,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: 2.2-slim
+              tag: 2.5-slim
           inputs:
           - name: paas-bootstrap
           - name: vpc-tfstate
diff --git a/concourse/pipelines/destroy-bosh-concourse.yml b/concourse/pipelines/destroy-bosh-concourse.yml
index 0c7b0da28..c4593a4d1 100644
--- a/concourse/pipelines/destroy-bosh-concourse.yml
+++ b/concourse/pipelines/destroy-bosh-concourse.yml
@@ -102,7 +102,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/self-update-pipelines
-              tag: 895cf6752c8ec64af05a3a735186b90acd3db65a
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: paas-bootstrap
           params:
@@ -139,7 +139,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: "2.2-slim"
+              tag: "2.5-slim"
           inputs:
           - name: paas-bootstrap
           - name: vpc-tfstate
@@ -224,7 +224,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
           - name: paas-bootstrap
           - name: bosh-secrets
@@ -249,7 +249,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: "2.2-slim"
+              tag: "2.5-slim"
           inputs:
           - name: paas-bootstrap
           - name: vpc-tfstate
@@ -362,7 +362,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: paas-bootstrap
             - name: bosh-secrets
@@ -392,7 +392,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: paas-bootstrap
             - name: bosh-secrets
@@ -416,7 +416,7 @@ jobs:
             type: docker-image
             source:
               repository: governmentpaas/bosh-cli-v2
-              tag: 777204b5c870fc7ebf0d2b7aa55fcccddfa29c4b
+              tag: 0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
           inputs:
             - name: paas-bootstrap
             - name: bosh-manifest
@@ -456,7 +456,7 @@ jobs:
             type: docker-image
             source:
               repository: ruby
-              tag: "2.2-slim"
+              tag: "2.5-slim"
           inputs:
             - name: paas-bootstrap
             - name: vpc-tfstate
diff --git a/scripts/bosh b/scripts/bosh
index a4d638b4c..239f4cc9d 100755
--- a/scripts/bosh
+++ b/scripts/bosh
@@ -54,5 +54,4 @@ docker run  \
 	--env "BOSH_ENVIRONMENT=bosh.${SYSTEM_DNS_ZONE_NAME}" \
 	--env "BOSH_CA_CERT" \
 	--env "BOSH_DEPLOYMENT=${DEPLOY_ENV}" \
-	governmentpaas/bosh:81417f366669e87c59e683f4ac93e0deda0625ba "$@"
-
+	governmentpaas/bosh:0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2 "$@"
diff --git a/scripts/bosh-cli.sh b/scripts/bosh-cli.sh
index ab9094780..ca511506d 100755
--- a/scripts/bosh-cli.sh
+++ b/scripts/bosh-cli.sh
@@ -26,4 +26,4 @@ docker run \
     --env "BOSH_ENVIRONMENT=bosh.${SYSTEM_DNS_ZONE_NAME}" \
     --env "BOSH_CA_CERT" \
     --env "BOSH_DEPLOYMENT=${DEPLOY_ENV}" \
-    governmentpaas/bosh-shell:c735581beb174ecc95ca1a7b57eff444af3bf099
+    governmentpaas/bosh-shell:0eff5b6a9c092f865a2b19cc4e75a3b539b82fa2
diff --git a/vagrant/Vagrantfile b/vagrant/Vagrantfile
index b70aa5c2f..35d3ce1db 100644
--- a/vagrant/Vagrantfile
+++ b/vagrant/Vagrantfile
@@ -99,3 +99,4 @@ Vagrant.configure(2) do |config|
     override.ssh.private_key_path = ENV['VAGRANT_SSH_KEY']
   end
 end
+# rubocop:enable Metrics/BlockLength