@@ -29,8 +29,11 @@ RUN curl -sSL https://rvm.io/mpapis.asc | gpg --import - \
 # Switch to a bash login shell to allow simple 'rvm' in RUN commands
 SHELL ["/bin/bash", "-l", "-c"]
 
+# Do NOT 'gem update --system' here. JRuby 9.2.20.0 ships RubyGems 3.1.6, which already
+# satisfies bundler 2.3.27 (needs >= 2.5.2). Replacing it breaks the default-gem activation
+# that jruby-openssl relies on to load its BouncyCastle jars, leaving OpenSSL with only its
+# Java half (SSLContext without #set_params) - which kills every later HTTPS gem fetch.
 RUN rvm install jruby-${JRUBY_VERSION} \
-    && gem update --system 3.3.26 \
     && gem install bundler -v 2.3.27 \
     && gem install rake -v 11.3.0