diff --git a/.circleci/config.yml b/.circleci/config.yml
index 284f463d..7e3cd27b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -115,3 +115,20 @@ workflows:
             - PagerDuty
             - Snyk
       - build
+
+  # Runs only on the cron schedule (not on git push). Cron is UTC.
+  # Project Settings → Triggers: ensure scheduled pipelines are allowed if required by your org.
+  weekly_snyk_scan:
+    triggers:
+      - schedule:
+          # Every Monday 06:00 UTC (~ Sun evening US Pacific)
+          cron: "0 6 * * 1"
+          filters:
+            branches:
+              only:
+                - main
+    jobs:
+      - snyk_test:
+          context:
+            - PagerDuty
+            - Snyk
diff --git a/docs/.ruby-version b/docs/.ruby-version
new file mode 100644
index 00000000..34cde569
--- /dev/null
+++ b/docs/.ruby-version
@@ -0,0 +1 @@
+3.2.6
diff --git a/docs/Gemfile b/docs/Gemfile
index 6e7c5ffb..535ade90 100644
--- a/docs/Gemfile
+++ b/docs/Gemfile
@@ -1,5 +1,6 @@
 source "https://rubygems.org"
-ruby RUBY_VERSION
+# Keep in sync with .ruby-version (Ruby 3+ required; Jekyll 4.3 + current ffi need Ruby >= 3.0)
+ruby "3.2.6"
 
 # Hello! This is where you manage which Jekyll version is used to run.
 # When you want to use a different version, change it below, save the
@@ -9,7 +10,7 @@ ruby RUBY_VERSION
 #
 # This will help ensure the proper Jekyll version is running.
 # Happy Jekylling!
-gem "jekyll", "4.2.2"
+gem "jekyll", "4.3.0"
 
 # This is the default theme for new Jekyll sites. You may change this to anything you like.
 gem "minima", "~> 2.5", ">= 2.5.1"
diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock
index 9e166f0e..8d12c56c 100644
--- a/docs/Gemfile.lock
+++ b/docs/Gemfile.lock
@@ -1,83 +1,91 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.0)
-      public_suffix (>= 2.0.2, < 5.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    bigdecimal (4.1.1)
     colorator (1.1.0)
-    concurrent-ruby (1.1.10)
+    concurrent-ruby (1.3.6)
     em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0)
     eventmachine (1.2.7)
-    ffi (1.15.5)
+    ffi (1.17.4)
     forwardable-extended (2.6.0)
-    http_parser.rb (0.8.0)
-    i18n (1.10.0)
+    google-protobuf (4.34.1)
+      bigdecimal
+      rake (~> 13.3)
+    http_parser.rb (0.8.1)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
-    jekyll (4.2.2)
+    jekyll (4.3.0)
       addressable (~> 2.4)
       colorator (~> 1.0)
       em-websocket (~> 0.5)
       i18n (~> 1.0)
-      jekyll-sass-converter (~> 2.0)
+      jekyll-sass-converter (>= 2.0, < 4.0)
       jekyll-watch (~> 2.0)
-      kramdown (~> 2.3)
+      kramdown (~> 2.3, >= 2.3.1)
       kramdown-parser-gfm (~> 1.0)
       liquid (~> 4.0)
-      mercenary (~> 0.4.0)
+      mercenary (>= 0.3.6, < 0.5)
       pathutil (~> 0.9)
-      rouge (~> 3.0)
+      rouge (>= 3.0, < 5.0)
       safe_yaml (~> 1.0)
-      terminal-table (~> 2.0)
-    jekyll-feed (0.15.0)
+      terminal-table (>= 1.8, < 4.0)
+      webrick (~> 1.7)
+    jekyll-feed (0.17.0)
       jekyll (>= 3.7, < 5.0)
-    jekyll-sass-converter (2.2.0)
-      sassc (> 2.0.1, < 3.0)
-    jekyll-seo-tag (2.6.1)
-      jekyll (>= 3.3, < 5.0)
+    jekyll-sass-converter (3.1.0)
+      sass-embedded (~> 1.75)
+    jekyll-seo-tag (2.8.0)
+      jekyll (>= 3.8, < 5.0)
     jekyll-watch (2.2.1)
       listen (~> 3.0)
-    kramdown (2.5.1)
-      rexml
+    kramdown (2.5.2)
+      rexml (>= 3.4.4)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
-    liquid (4.0.3)
-    listen (3.7.1)
+    liquid (4.0.4)
+    listen (3.10.0)
+      logger
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
+    logger (1.7.0)
     mercenary (0.4.0)
-    minima (2.5.1)
+    minima (2.5.2)
       jekyll (>= 3.5, < 5.0)
       jekyll-feed (~> 0.9)
       jekyll-seo-tag (~> 2.1)
     pathutil (0.16.2)
       forwardable-extended (~> 2.6)
-    public_suffix (4.0.6)
-    rb-fsevent (0.11.1)
-    rb-inotify (0.10.1)
+    public_suffix (7.0.5)
+    rake (13.4.1)
+    rb-fsevent (0.11.2)
+    rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rexml (3.3.9)
-      strscan
-    rouge (3.28.0)
+    rexml (3.4.4)
+    rouge (4.7.0)
     safe_yaml (1.0.5)
-    sassc (2.4.0)
-      ffi (~> 1.9)
-    strscan (3.1.0)
-    terminal-table (2.0.0)
-      unicode-display_width (~> 1.1, >= 1.1.1)
-    unicode-display_width (1.8.0)
+    sass-embedded (1.99.0)
+      google-protobuf (~> 4.31)
+      rake (>= 13)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
+    unicode-display_width (2.6.0)
+    webrick (1.9.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  jekyll (= 4.2.2)
+  jekyll (= 4.3.0)
   jekyll-feed (~> 0.12, >= 0.12.0)
   kramdown (>= 2.3.0)
   minima (~> 2.5, >= 2.5.1)
 
 RUBY VERSION
-   ruby 2.7.5p203
+  ruby 3.2.6
 
 BUNDLED WITH
-   1.17.2
+  4.0.10