diff --git a/Gemfile b/Gemfile
index 89f59334..22ea177c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -15,7 +15,7 @@ gem 'packaging', *location_for(ENV['PACKAGING_LOCATION'] || '~> 0.105')
 gem 'rake', '~> 13.0'
 gem 'rubocop', '~> 1.86'
 gem 'rubocop-rake', '~> 0.7'
-gem 'vanagon', *location_for(ENV['VANAGON_LOCATION'] || 'https://github.com/openvoxproject/vanagon#main')
+gem 'vanagon', *location_for(ENV['VANAGON_LOCATION'] || 'https://github.com/openvoxproject/vanagon#archlinux')
 # Need to update the openssl gem on MacOS to avoid SSL errors.
 # https://www.rubyonmac.dev/certificate-verify-failed-unable-to-get-certificate-crl-openssl-ssl-sslerror
 gem 'openssl', '~> 3' if RUBY_PLATFORM =~ /darwin/
diff --git a/Rakefile b/Rakefile
index f475e882..b4a68ddf 100644
--- a/Rakefile
+++ b/Rakefile
@@ -25,4 +25,17 @@ def run_command(cmd, silent: true, print_command: false, report_status: false)
   output.chomp
 end
 
+begin
+  require 'rubocop/rake_task'
+rescue LoadError
+  # Do nothing if no required gem installed
+else
+  RuboCop::RakeTask.new(:rubocop) do |task|
+    # These make the rubocop experience maybe slightly less terrible
+    task.options = ['--display-cop-names', '--display-style-guide', '--extra-details']
+    # Use Rubocop's Github Actions formatter if possible
+    task.formatters << 'github' if ENV['GITHUB_ACTIONS'] == 'true'
+  end
+end
+
 Dir.glob(File.join('tasks/**/*.rake')).each { |file| load file }
diff --git a/configs/components/_base-ruby.rb b/configs/components/_base-ruby.rb
index 210e0ca9..e1811882 100644
--- a/configs/components/_base-ruby.rb
+++ b/configs/components/_base-ruby.rb
@@ -40,7 +40,7 @@
 # BUILD REQUIREMENTS
 ####################
 
-pkg.build_requires "openssl-#{settings[:openssl_version]}"
+pkg.build_requires(platform.is_archlinux? ? 'openssl' : "openssl-#{settings[:openssl_version]}")
 
 #######
 # BUILD
diff --git a/configs/components/_base-rubygem.rb b/configs/components/_base-rubygem.rb
index 4ac000de..ce122514 100644
--- a/configs/components/_base-rubygem.rb
+++ b/configs/components/_base-rubygem.rb
@@ -20,7 +20,8 @@
 # When cross-compiling, we can't use the rubygems we just built.
 # Instead we use the host gem installation and override GEM_HOME. Yay?
 pkg.environment 'GEM_HOME', settings[:gem_home]
-pkg.environment 'GEM_PATH', settings[:gem_home]
+gem_path = [settings[:gem_home], settings[:system_gem_path]].compact.join(':')
+pkg.environment 'GEM_PATH', gem_path
 
 # PA-25 in order to install gems in a cross-compiled environment we need to
 # set RUBYLIB to include puppet and hiera, so that their gemspecs can resolve
diff --git a/configs/components/curl.rb b/configs/components/curl.rb
index cfb12d15..5592ae81 100644
--- a/configs/components/curl.rb
+++ b/configs/components/curl.rb
@@ -5,7 +5,7 @@
   pkg.load_from_json('configs/components/curl.json')
   pkg.mirror "#{settings[:buildsources_url]}/curl-#{pkg.get_version}.tar.gz"
 
-  pkg.build_requires "openssl-#{settings[:openssl_version]}"
+  pkg.build_requires(platform.is_archlinux? ? 'openssl' : "openssl-#{settings[:openssl_version]}")
   pkg.build_requires 'puppet-ca-bundle-8.x'
 
   ldflags = settings[:ldflags]
diff --git a/configs/components/openssl-3.0.rb b/configs/components/openssl-3.0.rb
index dc3e485b..9d09b822 100644
--- a/configs/components/openssl-3.0.rb
+++ b/configs/components/openssl-3.0.rb
@@ -6,132 +6,137 @@
 #   need to move to the 3.5.x LTS stream in the next year.
 #####
 component 'openssl' do |pkg, settings, platform|
-  pkg.load_from_json('configs/components/openssl-3.0.json')
-  pkg.mirror "#{settings[:buildsources_url]}/openssl-#{pkg.get_version}.tar.gz"
+  if platform.is_archlinux?
+    pkg.build_requires 'openssl'
+    pkg.install_only true
+  else
+    pkg.load_from_json('configs/components/openssl-3.0.json')
+    pkg.mirror "#{settings[:buildsources_url]}/openssl-#{pkg.get_version}.tar.gz"
 
-  #############################
-  # ENVIRONMENT, FLAGS, TARGETS
-  #############################
+    #############################
+    # ENVIRONMENT, FLAGS, TARGETS
+    #############################
 
-  if platform.is_rpm? && !platform.is_sles?
-    pkg.build_requires 'perl-core'
-  else
-    pkg.build_requires 'perl'
-  end
+    if platform.is_rpm? && !platform.is_sles?
+      pkg.build_requires 'perl-core'
+    else
+      pkg.build_requires 'perl'
+    end
 
-  target = sslflags = ''
-  cflags = settings[:cflags]
-  ldflags = settings[:ldflags]
-
-  if platform.is_windows?
-    pkg.environment 'PATH', "$(shell cygpath -u #{settings[:gcc_bindir]}):$(PATH)"
-    pkg.environment 'CYGWIN', settings[:cygwin]
-    pkg.environment 'MAKE', platform[:make]
-
-    target = 'mingw64'
-  elsif platform.is_macos?
-    pkg.environment 'PATH', '$(PATH):/opt/homebrew/bin:/usr/local/bin'
-    pkg.environment 'CC', settings[:cc]
-    pkg.environment 'MACOSX_DEPLOYMENT_TARGET', settings[:deployment_target]
-
-    target = "darwin64-#{platform.architecture}"
-
-  elsif platform.is_linux?
-    pkg.environment 'PATH', '$(PATH):/usr/local/bin'
-
-    ldflags = "#{settings[:ldflags]} -Wl,-z,relro"
-    case platform.architecture
-    when /aarch64$/
-      target = 'linux-aarch64'
-    when /64$/
-      target = 'linux-x86_64'
-    when 'armhf'
-      target = 'linux-armv4'
+    target = sslflags = ''
+    cflags = settings[:cflags]
+    ldflags = settings[:ldflags]
+
+    if platform.is_windows?
+      pkg.environment 'PATH', "$(shell cygpath -u #{settings[:gcc_bindir]}):$(PATH)"
+      pkg.environment 'CYGWIN', settings[:cygwin]
+      pkg.environment 'MAKE', platform[:make]
+
+      target = 'mingw64'
+    elsif platform.is_macos?
+      pkg.environment 'PATH', '$(PATH):/opt/homebrew/bin:/usr/local/bin'
+      pkg.environment 'CC', settings[:cc]
+      pkg.environment 'MACOSX_DEPLOYMENT_TARGET', settings[:deployment_target]
+
+      target = "darwin64-#{platform.architecture}"
+
+    elsif platform.is_linux?
+      pkg.environment 'PATH', '$(PATH):/usr/local/bin'
+
+      ldflags = "#{settings[:ldflags]} -Wl,-z,relro"
+      case platform.architecture
+      when /aarch64$/
+        target = 'linux-aarch64'
+      when /64$/
+        target = 'linux-x86_64'
+      when 'armhf'
+        target = 'linux-armv4'
+      end
     end
-  end
 
-  ####################
-  # BUILD REQUIREMENTS
-  ####################
-
-  pkg.build_requires "runtime-#{settings[:runtime_project]}"
-
-  ###########
-  # CONFIGURE
-  ###########
-
-  # Defining --libdir ensures that we avoid the multilib (lib/ vs. lib64/) problem,
-  # since configure uses the existence of a lib64 directory to determine
-  # if it should install its own libs into a multilib dir. Yay OpenSSL!
-  configure_flags = [
-    "--prefix=#{settings[:prefix]}",
-    '--libdir=lib',
-    "--openssldir=#{settings[:prefix]}/ssl",
-    'shared',
-    'no-gost',
-    target,
-    sslflags,
-    'no-camellia',
-    'no-md2',
-    'no-ssl3',
-    'no-ssl3-method',
-    'no-dtls1-method',
-    'no-dtls1_2-method',
-    'no-aria',
-    # 'no-bf', pgcrypto is requires this cipher in postgres for OpenVoxDB
-    # 'no-cast', pgcrypto is requires this cipher in postgres for OpenVoxDB
-    # 'no-des', pgcrypto is requires this cipher in postgres for OpenVoxDB,
-    # should pgcrypto cease needing it, it will also be needed by ntlm
-    # and should only be enabled if "use_legacy_openssl_algos" is true.
-    'no-rc5',
-    'no-mdc2',
-    # 'no-rmd160', this is causing failures with pxp, remove once pxp-agent does not need it
-    'no-whirlpool'
-  ]
-
-  if settings[:use_legacy_openssl_algos]
-    pkg.apply_patch 'resources/patches/openssl/openssl-3-activate-legacy-algos.patch'
-  else
-    configure_flags << 'no-legacy' << 'no-md4'
-  end
+    ####################
+    # BUILD REQUIREMENTS
+    ####################
+
+    pkg.build_requires "runtime-#{settings[:runtime_project]}"
+
+    ###########
+    # CONFIGURE
+    ###########
+
+    # Defining --libdir ensures that we avoid the multilib (lib/ vs. lib64/) problem,
+    # since configure uses the existence of a lib64 directory to determine
+    # if it should install its own libs into a multilib dir. Yay OpenSSL!
+    configure_flags = [
+      "--prefix=#{settings[:prefix]}",
+      '--libdir=lib',
+      "--openssldir=#{settings[:prefix]}/ssl",
+      'shared',
+      'no-gost',
+      target,
+      sslflags,
+      'no-camellia',
+      'no-md2',
+      'no-ssl3',
+      'no-ssl3-method',
+      'no-dtls1-method',
+      'no-dtls1_2-method',
+      'no-aria',
+      # 'no-bf', pgcrypto is requires this cipher in postgres for OpenVoxDB
+      # 'no-cast', pgcrypto is requires this cipher in postgres for OpenVoxDB
+      # 'no-des', pgcrypto is requires this cipher in postgres for OpenVoxDB,
+      # should pgcrypto cease needing it, it will also be needed by ntlm
+      # and should only be enabled if "use_legacy_openssl_algos" is true.
+      'no-rc5',
+      'no-mdc2',
+      # 'no-rmd160', this is causing failures with pxp, remove once pxp-agent does not need it
+      'no-whirlpool'
+    ]
+
+    if settings[:use_legacy_openssl_algos]
+      pkg.apply_patch 'resources/patches/openssl/openssl-3-activate-legacy-algos.patch'
+    else
+      configure_flags << 'no-legacy' << 'no-md4'
+    end
 
-  # Individual projects may provide their own openssl configure flags:
-  project_flags = settings[:openssl_extra_configure_flags] || []
-  configure_flags << project_flags
+    # Individual projects may provide their own openssl configure flags:
+    project_flags = settings[:openssl_extra_configure_flags] || []
+    configure_flags << project_flags
 
-  pkg.environment 'CFLAGS', cflags
-  pkg.environment 'LDFLAGS', ldflags
-  pkg.configure do
-    ["./Configure #{configure_flags.join(' ')}"]
-  end
+    pkg.environment 'CFLAGS', cflags
+    pkg.environment 'LDFLAGS', ldflags
+    pkg.configure do
+      ["./Configure #{configure_flags.join(' ')}"]
+    end
 
-  #######
-  # BUILD
-  #######
+    #######
+    # BUILD
+    #######
 
-  build_commands = []
+    build_commands = []
 
-  build_commands << "#{platform[:make]} depend"
-  build_commands << platform[:make]
+    build_commands << "#{platform[:make]} depend"
+    build_commands << platform[:make]
 
-  pkg.build do
-    build_commands
-  end
+    pkg.build do
+      build_commands
+    end
 
-  #########
-  # INSTALL
-  #########
+    #########
+    # INSTALL
+    #########
 
-  install_prefix = platform.is_windows? ? '' : 'INSTALL_PREFIX=/'
-  install_commands = []
+    install_prefix = platform.is_windows? ? '' : 'INSTALL_PREFIX=/'
+    install_commands = []
 
-  # Skip man and html docs
-  install_commands << "#{platform[:make]} #{install_prefix} install_sw install_ssldirs"
-  install_commands << "rm -f #{settings[:prefix]}/bin/c_rehash"
+    # Skip man and html docs
+    install_commands << "#{platform[:make]} #{install_prefix} install_sw install_ssldirs"
+    install_commands << "rm -f #{settings[:prefix]}/bin/c_rehash"
 
-  pkg.install do
-    install_commands
-  end
+    pkg.install do
+      install_commands
+    end
 
-  pkg.install_file 'LICENSE.txt', "#{settings[:prefix]}/share/doc/openssl-#{pkg.get_version}/LICENSE"
+    pkg.install_file 'LICENSE.txt', "#{settings[:prefix]}/share/doc/openssl-#{pkg.get_version}/LICENSE"
+  end
 end
diff --git a/configs/components/puppet-ca-bundle-8.x.rb b/configs/components/puppet-ca-bundle-8.x.rb
index 05fbd332..4102549f 100644
--- a/configs/components/puppet-ca-bundle-8.x.rb
+++ b/configs/components/puppet-ca-bundle-8.x.rb
@@ -1,7 +1,7 @@
 component 'puppet-ca-bundle-8.x' do |pkg, settings, platform|
   pkg.load_from_json('configs/components/puppet-ca-bundle-8.x.json')
 
-  pkg.build_requires "openssl-#{settings[:openssl_version]}"
+  pkg.build_requires(platform.is_archlinux? ? 'openssl' : "openssl-#{settings[:openssl_version]}")
 
   openssl_cmd = "#{settings[:bindir]}/openssl"
 
diff --git a/configs/components/puppet-ca-bundle-main.rb b/configs/components/puppet-ca-bundle-main.rb
index b3d75cea..a173524d 100644
--- a/configs/components/puppet-ca-bundle-main.rb
+++ b/configs/components/puppet-ca-bundle-main.rb
@@ -1,7 +1,7 @@
 component 'puppet-ca-bundle-main' do |pkg, settings, platform|
   pkg.load_from_json('configs/components/puppet-ca-bundle-main.json')
 
-  pkg.build_requires "openssl-#{settings[:openssl_version]}"
+  pkg.build_requires(platform.is_archlinux? ? 'openssl' : "openssl-#{settings[:openssl_version]}")
 
   openssl_cmd = "#{settings[:bindir]}/openssl"
 
diff --git a/configs/components/ruby-3.2.rb b/configs/components/ruby-3.2.rb
index 0cc6c674..aec0d110 100644
--- a/configs/components/ruby-3.2.rb
+++ b/configs/components/ruby-3.2.rb
@@ -6,229 +6,235 @@
 #   The file name of the ruby component must match the ruby_version
 #####
 component 'ruby-3.2' do |pkg, settings, platform|
-  pkg.load_from_json('configs/components/ruby-3.2.json')
+  if platform.is_archlinux?
+    pkg.build_requires 'ruby'
+    pkg.build_requires 'ruby-stdlib'
+    pkg.install_only true
+  else
+    pkg.load_from_json('configs/components/ruby-3.2.json')
 
-  ruby_dir = settings[:ruby_dir]
-  ruby_bindir = settings[:ruby_bindir]
-  host_ruby = settings[:host_ruby]
+    ruby_dir = settings[:ruby_dir]
+    ruby_bindir = settings[:ruby_bindir]
+    host_ruby = settings[:host_ruby]
 
-  # rbconfig-update is used to munge rbconfigs after the fact.
-  pkg.add_source('file://resources/files/ruby/rbconfig-update.rb')
+    # rbconfig-update is used to munge rbconfigs after the fact.
+    pkg.add_source('file://resources/files/ruby/rbconfig-update.rb')
 
-  # Most ruby configuration happens in the base ruby config:
-  instance_eval File.read('configs/components/_base-ruby.rb')
+    # Most ruby configuration happens in the base ruby config:
+    instance_eval File.read('configs/components/_base-ruby.rb')
 
-  #########
-  # PATCHES
-  #########
+    #########
+    # PATCHES
+    #########
 
-  base = 'resources/patches/ruby_32'
+    base = 'resources/patches/ruby_32'
 
-  if platform.is_windows?
-    pkg.apply_patch "#{base}/windows_mingw32_mkmf.patch"
-    pkg.apply_patch "#{base}/ruby-faster-load_32.patch"
-    pkg.apply_patch "#{base}/revert_speed_up_rebuilding_loaded_feature_index.patch"
-    pkg.apply_patch "#{base}/revert-ruby-double-load-symlink.patch"
-    pkg.apply_patch "#{base}/revert_ruby_utf8_default_encoding.patch"
-  end
+    if platform.is_windows?
+      pkg.apply_patch "#{base}/windows_mingw32_mkmf.patch"
+      pkg.apply_patch "#{base}/ruby-faster-load_32.patch"
+      pkg.apply_patch "#{base}/revert_speed_up_rebuilding_loaded_feature_index.patch"
+      pkg.apply_patch "#{base}/revert-ruby-double-load-symlink.patch"
+      pkg.apply_patch "#{base}/revert_ruby_utf8_default_encoding.patch"
+    end
 
-  if platform.is_fips?
-    # This is needed on Ruby < 3.3 until the fix is backported (if ever)
-    # See: https://bugs.ruby-lang.org/issues/20000
-    pkg.apply_patch "#{base}/openssl3_fips.patch"
-  end
+    if platform.is_fips?
+      # This is needed on Ruby < 3.3 until the fix is backported (if ever)
+      # See: https://bugs.ruby-lang.org/issues/20000
+      pkg.apply_patch "#{base}/openssl3_fips.patch"
+    end
 
-  # Upgrade erb 4.0.2 -> 4.0.3.1, fixes CVE-2026-41316
-  pkg.apply_patch "#{base}/upgrade-erb-4.0.3.1.patch"
+    # Upgrade erb 4.0.2 -> 4.0.3.1, fixes CVE-2026-41316
+    pkg.apply_patch "#{base}/upgrade-erb-4.0.3.1.patch"
+
+    # Upgrade net-imap 0.3.9 -> 0.6.4.1, fixes CVE-2026-42246, CVE-2026-47240,
+    # other CVEs, and build issues.
+    pkg.add_source(
+      'https://rubygems.org/downloads/net-imap-0.6.4.1.gem',
+      {
+        sum: '29f0360d75a7efd3539f16ac1957dea5c0a51ddeceb348db4553c3120914ea0d',
+        sum_type: 'sha256'
+      }
+    )
+    pkg.configure do
+      [
+        'cp ../net-imap-0.6.4.1.gem gems/',
+        "sed -i.bak 's/^net-imap.*/net-imap 0.6.4.1 https:\\/\\/github.com\\/ruby\\/net-imap/' gems/bundled_gems",
+        # This next bit can be done via "make extract-gems", but that requires us
+        # to have a "baseruby" installed.
+        'tar xf gems/net-imap-0.6.4.1.gem',
+        'mkdir .bundle/gems/net-imap-0.6.4.1',
+        'tar -C .bundle/gems/net-imap-0.6.4.1 -xzf data.tar.gz'
+      ]
+    end
 
-  # Upgrade net-imap 0.3.9 -> 0.6.4.1, fixes CVE-2026-42246, CVE-2026-47240,
-  # other CVEs, and build issues.
-  pkg.add_source(
-    'https://rubygems.org/downloads/net-imap-0.6.4.1.gem',
-    {
-      sum: '29f0360d75a7efd3539f16ac1957dea5c0a51ddeceb348db4553c3120914ea0d',
-      sum_type: 'sha256'
-    }
-  )
-  pkg.configure do
-    [
-      'cp ../net-imap-0.6.4.1.gem gems/',
-      "sed -i.bak 's/^net-imap.*/net-imap 0.6.4.1 https:\\/\\/github.com\\/ruby\\/net-imap/' gems/bundled_gems",
-      # This next bit can be done via "make extract-gems", but that requires us
-      # to have a "baseruby" installed.
-      'tar xf gems/net-imap-0.6.4.1.gem',
-      'mkdir .bundle/gems/net-imap-0.6.4.1',
-      'tar -C .bundle/gems/net-imap-0.6.4.1 -xzf data.tar.gz'
-    ]
-  end
+    ####################
+    # ENVIRONMENT, FLAGS
+    ####################
+
+    cflags = settings[:cflags]
+    cppflags = settings[:cppflags]
+    if platform.is_macos?
+      pkg.environment 'optflags', cflags
+      pkg.environment 'CFLAGS', cflags
+      pkg.environment 'CPPFLAGS', cppflags
+      pkg.environment 'LDFLAGS', settings[:ldflags]
+      pkg.environment 'CC', settings[:cc]
+      pkg.environment 'CXX', settings[:cxx]
+      pkg.environment 'MACOSX_DEPLOYMENT_TARGET', settings[:deployment_target]
+      pkg.environment 'PATH', '$(PATH):/opt/homebrew/bin:/usr/local/bin'
+    elsif platform.is_windows?
+      optflags = "#{cflags} -O3"
+      pkg.environment 'optflags', optflags
+      pkg.environment 'CFLAGS', optflags
+      pkg.environment 'MAKE', 'make'
+    else
+      pkg.environment 'optflags', '-O2'
+    end
 
-  ####################
-  # ENVIRONMENT, FLAGS
-  ####################
-
-  cflags = settings[:cflags]
-  cppflags = settings[:cppflags]
-  if platform.is_macos?
-    pkg.environment 'optflags', cflags
-    pkg.environment 'CFLAGS', cflags
-    pkg.environment 'CPPFLAGS', cppflags
-    pkg.environment 'LDFLAGS', settings[:ldflags]
-    pkg.environment 'CC', settings[:cc]
-    pkg.environment 'CXX', settings[:cxx]
-    pkg.environment 'MACOSX_DEPLOYMENT_TARGET', settings[:deployment_target]
-    pkg.environment 'PATH', '$(PATH):/opt/homebrew/bin:/usr/local/bin'
-  elsif platform.is_windows?
-    optflags = "#{cflags} -O3"
-    pkg.environment 'optflags', optflags
-    pkg.environment 'CFLAGS', optflags
-    pkg.environment 'MAKE', 'make'
-  else
-    pkg.environment 'optflags', '-O2'
-  end
+    special_flags = " --prefix=#{ruby_dir} --with-opt-dir=#{settings[:prefix]} "
 
-  special_flags = " --prefix=#{ruby_dir} --with-opt-dir=#{settings[:prefix]} "
+    if (platform.is_debian? && platform.os_version.to_i >= 13) || (platform.is_ubuntu? && platform.os_version.to_f >= 25.04 || platform.is_sles? && platform.os_version.to_i >= 16)
+      # A problem with --enable-dtrace, which I suspect may be because of GCC on the Trixie image.
+      # Check if this is still needed next time we bump Ruby and/or bump the Debian 13
+      # container to the release version.
+      cflags += ' -Wno-error=implicit-function-declaration '
+    end
 
-  if (platform.is_debian? && platform.os_version.to_i >= 13) || (platform.is_ubuntu? && platform.os_version.to_f >= 25.04 || platform.is_sles? && platform.os_version.to_i >= 16)
-    # A problem with --enable-dtrace, which I suspect may be because of GCC on the Trixie image.
-    # Check if this is still needed next time we bump Ruby and/or bump the Debian 13
-    # container to the release version.
-    cflags += ' -Wno-error=implicit-function-declaration '
-  end
+    special_flags += " CFLAGS='#{cflags}' LDFLAGS='#{settings[:ldflags]}' CPPFLAGS='#{settings[:cppflags]}' " if settings[:supports_pie]
 
-  special_flags += " CFLAGS='#{cflags}' LDFLAGS='#{settings[:ldflags]}' CPPFLAGS='#{settings[:cppflags]}' " if settings[:supports_pie]
-
-  # Ruby's build process requires a "base" ruby and we need a ruby to install
-  # gems into the /opt/puppetlabs/puppet/lib directory.
-  #
-  # For native compiles, we don't want ruby's build process to use whatever ruby
-  # is in the PATH, as it's probably too old to build ruby 3.2. And we don't
-  # want to use/maintain pl-ruby if we don't have to. Instead set baseruby to
-  # "no" which will force ruby to build and use miniruby.
-  special_flags += ' --with-baseruby=no '
-
-  if platform.is_windows?
-    # ruby's configure script guesses the build host is `cygwin`, because we're using
-    # cygwin opensshd & bash. So mkmf will convert compiler paths, e.g. -IC:/... to
-    # cygwin paths, -I/cygdrive/c/..., which confuses mingw-w64. So specify the build
-    # target explicitly.
-    special_flags += " CPPFLAGS='-DFD_SETSIZE=2048' debugflags=-g "
-
-    special_flags += if platform.architecture == 'x64'
-                       ' --build x86_64-w64-mingw32 '
-                     else
-                       ' --build i686-w64-mingw32 '
-                     end
-  elsif platform.is_macos?
-    special_flags += " --with-openssl-dir=#{settings[:prefix]} "
-    # configure will pick up libgmp from Homebrew, and the resulting compiler
-    # warnings cause mis-configuration.
-    special_flags += ' --without-gmp '
-  end
+    # Ruby's build process requires a "base" ruby and we need a ruby to install
+    # gems into the /opt/puppetlabs/puppet/lib directory.
+    #
+    # For native compiles, we don't want ruby's build process to use whatever ruby
+    # is in the PATH, as it's probably too old to build ruby 3.2. And we don't
+    # want to use/maintain pl-ruby if we don't have to. Instead set baseruby to
+    # "no" which will force ruby to build and use miniruby.
+    special_flags += ' --with-baseruby=no '
+
+    if platform.is_windows?
+      # ruby's configure script guesses the build host is `cygwin`, because we're using
+      # cygwin opensshd & bash. So mkmf will convert compiler paths, e.g. -IC:/... to
+      # cygwin paths, -I/cygdrive/c/..., which confuses mingw-w64. So specify the build
+      # target explicitly.
+      special_flags += " CPPFLAGS='-DFD_SETSIZE=2048' debugflags=-g "
+
+      special_flags += if platform.architecture == 'x64'
+                         ' --build x86_64-w64-mingw32 '
+                       else
+                         ' --build i686-w64-mingw32 '
+                       end
+    elsif platform.is_macos?
+      special_flags += " --with-openssl-dir=#{settings[:prefix]} "
+      # configure will pick up libgmp from Homebrew, and the resulting compiler
+      # warnings cause mis-configuration.
+      special_flags += ' --without-gmp '
+    end
 
-  without_dtrace = [
-    'macos-all-arm64',
-    'macos-all-x86_64',
-    'redhatfips-7-x86_64',
-    'windows-all-x64',
-    'windowsfips-2016-x64'
-  ]
+    without_dtrace = [
+      'macos-all-arm64',
+      'macos-all-x86_64',
+      'redhatfips-7-x86_64',
+      'windows-all-x64',
+      'windowsfips-2016-x64'
+    ]
 
-  special_flags += ' --enable-dtrace ' unless without_dtrace.include? platform.name
+    special_flags += ' --enable-dtrace ' unless without_dtrace.include? platform.name
 
-  ###########
-  # CONFIGURE
-  ###########
+    ###########
+    # CONFIGURE
+    ###########
 
-  pkg.configure { ['bash autogen.sh'] }
+    pkg.configure { ['bash autogen.sh'] }
 
-  pkg.configure do
-    [
-      "bash configure \
+    pkg.configure do
+      [
+        "bash configure \
         --enable-shared \
         --disable-install-doc \
         --disable-install-rdoc \
         #{settings[:host]} \
         #{special_flags}"
-    ]
-  end
-
-  #########
-  # INSTALL
-  #########
+      ]
+    end
 
-  if platform.is_windows?
-    # Ruby 3.2 copies bin/gem to $ruby_bindir/gem.cmd, but generates bat files for
-    # other gems like bundle.bat, irb.bat, etc. Just rename the cmd.cmd to cmd.bat
-    # as we used to in ruby 2.7 and earlier.
-    #
-    # Note that this step must happen after the install step above.
-    pkg.install do
-      %w[gem].map do |name|
-        "mv #{ruby_bindir}/#{name}.cmd #{ruby_bindir}/#{name}.bat"
+    #########
+    # INSTALL
+    #########
+
+    if platform.is_windows?
+      # Ruby 3.2 copies bin/gem to $ruby_bindir/gem.cmd, but generates bat files for
+      # other gems like bundle.bat, irb.bat, etc. Just rename the cmd.cmd to cmd.bat
+      # as we used to in ruby 2.7 and earlier.
+      #
+      # Note that this step must happen after the install step above.
+      pkg.install do
+        %w[gem].map do |name|
+          "mv #{ruby_bindir}/#{name}.cmd #{ruby_bindir}/#{name}.bat"
+        end
       end
-    end
 
-    # Required when using `stack-protection-strong` and older versions of mingw-w64-gcc
-    pkg.install_file File.join(settings[:gcc_bindir], 'libssp-0.dll'), File.join(settings[:bindir], 'libssp-0.dll')
-  end
+      # Required when using `stack-protection-strong` and older versions of mingw-w64-gcc
+      pkg.install_file File.join(settings[:gcc_bindir], 'libssp-0.dll'), File.join(settings[:bindir], 'libssp-0.dll')
+    end
 
-  target_doubles = {
-    'aarch64-redhat-linux' => 'aarch64-linux',
-    'powerpc64le-suse-linux' => 'powerpc64le-linux',
-    'powerpc64le-linux-gnu' => 'powerpc64le-linux',
-    'arm-linux-gnueabihf' => 'arm-linux-eabihf',
-    'arm-linux-gnueabi' => 'arm-linux-eabi',
-    'x86_64-w64-mingw32' => 'x64-mingw32',
-    'i686-w64-mingw32' => 'i386-mingw32'
-  }
-  rbconfig_topdir = if target_doubles.key?(settings[:platform_triple])
-                      File.join(ruby_dir, 'lib', 'ruby', '3.2.0', target_doubles[settings[:platform_triple]])
-                    else
-                      "$$(#{ruby_bindir}/ruby -e \"puts RbConfig::CONFIG[\\\"topdir\\\"]\")"
-                    end
-
-  # When cross compiling or building on non-linux, we sometimes need to patch
-  # the rbconfig.rb in the "host" ruby so that later when we try to build gems
-  # with native extensions, like ffi, the "host" ruby's mkmf will use the CC,
-  # etc specified below. For example, if we're building on mac Intel for ARM,
-  # then the CC override allows us to build ffi_c.so for ARM as well. The
-  # "host" ruby is configured in _shared-agent-settings
-  rbconfig_changes = {}
-  if platform.is_macos?
-    rbconfig_changes['CC'] = "#{settings[:cc]} #{cflags}"
-  elsif platform.is_windows?
-    rbconfig_changes['CC'] = if platform.architecture == 'x64'
-                               'x86_64-w64-mingw32-gcc'
-                             else
-                               'i686-w64-mingw32-gcc'
-                             end
-  end
+    target_doubles = {
+      'aarch64-redhat-linux' => 'aarch64-linux',
+      'powerpc64le-suse-linux' => 'powerpc64le-linux',
+      'powerpc64le-linux-gnu' => 'powerpc64le-linux',
+      'arm-linux-gnueabihf' => 'arm-linux-eabihf',
+      'arm-linux-gnueabi' => 'arm-linux-eabi',
+      'x86_64-w64-mingw32' => 'x64-mingw32',
+      'i686-w64-mingw32' => 'i386-mingw32'
+    }
+    rbconfig_topdir = if target_doubles.key?(settings[:platform_triple])
+                        File.join(ruby_dir, 'lib', 'ruby', '3.2.0', target_doubles[settings[:platform_triple]])
+                      else
+                        "$$(#{ruby_bindir}/ruby -e \"puts RbConfig::CONFIG[\\\"topdir\\\"]\")"
+                      end
+
+    # When cross compiling or building on non-linux, we sometimes need to patch
+    # the rbconfig.rb in the "host" ruby so that later when we try to build gems
+    # with native extensions, like ffi, the "host" ruby's mkmf will use the CC,
+    # etc specified below. For example, if we're building on mac Intel for ARM,
+    # then the CC override allows us to build ffi_c.so for ARM as well. The
+    # "host" ruby is configured in _shared-agent-settings
+    rbconfig_changes = {}
+    if platform.is_macos?
+      rbconfig_changes['CC'] = "#{settings[:cc]} #{cflags}"
+    elsif platform.is_windows?
+      rbconfig_changes['CC'] = if platform.architecture == 'x64'
+                                 'x86_64-w64-mingw32-gcc'
+                               else
+                                 'i686-w64-mingw32-gcc'
+                               end
+    end
 
-  pkg.add_source('file://resources/files/ruby_vendor_gems/operating_system.rb')
-  defaults_dir = File.join(settings[:libdir], 'ruby/3.2.0/rubygems/defaults')
-  pkg.directory(defaults_dir)
-  pkg.install_file '../operating_system.rb', File.join(defaults_dir, 'operating_system.rb')
+    pkg.add_source('file://resources/files/ruby_vendor_gems/operating_system.rb')
+    defaults_dir = File.join(settings[:libdir], 'ruby/3.2.0/rubygems/defaults')
+    pkg.directory(defaults_dir)
+    pkg.install_file '../operating_system.rb', File.join(defaults_dir, 'operating_system.rb')
 
-  certs_dir = File.join(settings[:libdir], 'ruby/3.2.0/rubygems/ssl_certs/puppetlabs.net')
-  pkg.directory(certs_dir)
+    certs_dir = File.join(settings[:libdir], 'ruby/3.2.0/rubygems/ssl_certs/puppetlabs.net')
+    pkg.directory(certs_dir)
 
-  pkg.add_source('file://resources/files/rubygems/COMODO_RSA_Certification_Authority.pem')
-  pkg.install_file '../COMODO_RSA_Certification_Authority.pem',
-                   File.join(certs_dir, 'COMODO_RSA_Certification_Authority.pem')
+    pkg.add_source('file://resources/files/rubygems/COMODO_RSA_Certification_Authority.pem')
+    pkg.install_file '../COMODO_RSA_Certification_Authority.pem',
+                     File.join(certs_dir, 'COMODO_RSA_Certification_Authority.pem')
 
-  pkg.add_source('file://resources/files/rubygems/GlobalSignRootCA_R3.pem')
-  pkg.install_file '../GlobalSignRootCA_R3.pem', File.join(certs_dir, 'GlobalSignRootCA_R3.pem')
+    pkg.add_source('file://resources/files/rubygems/GlobalSignRootCA_R3.pem')
+    pkg.install_file '../GlobalSignRootCA_R3.pem', File.join(certs_dir, 'GlobalSignRootCA_R3.pem')
 
-  pkg.add_source('file://resources/files/rubygems/DigiCertGlobalRootG2.pem')
-  pkg.install_file '../DigiCertGlobalRootG2.pem', File.join(certs_dir, 'DigiCertGlobalRootG2.pem')
+    pkg.add_source('file://resources/files/rubygems/DigiCertGlobalRootG2.pem')
+    pkg.install_file '../DigiCertGlobalRootG2.pem', File.join(certs_dir, 'DigiCertGlobalRootG2.pem')
 
-  if rbconfig_changes.any?
-    pkg.install do
-      [
-        "#{host_ruby} ../rbconfig-update.rb \"#{rbconfig_changes.to_s.gsub('"', '\"')}\" #{rbconfig_topdir}",
-        "cp original_rbconfig.rb #{settings[:datadir]}/doc/rbconfig-#{pkg.get_version}-orig.rb",
-        "cp new_rbconfig.rb #{rbconfig_topdir}/rbconfig.rb"
-      ]
+    if rbconfig_changes.any?
+      pkg.install do
+        [
+          "#{host_ruby} ../rbconfig-update.rb \"#{rbconfig_changes.to_s.gsub('"', '\"')}\" #{rbconfig_topdir}",
+          "cp original_rbconfig.rb #{settings[:datadir]}/doc/rbconfig-#{pkg.get_version}-orig.rb",
+          "cp new_rbconfig.rb #{rbconfig_topdir}/rbconfig.rb"
+        ]
+      end
     end
   end
 end
diff --git a/configs/components/ruby-augeas.rb b/configs/components/ruby-augeas.rb
index 12e3d68d..fea7dbe7 100644
--- a/configs/components/ruby-augeas.rb
+++ b/configs/components/ruby-augeas.rb
@@ -4,14 +4,14 @@
 #####
 component 'ruby-augeas' do |pkg, settings, platform|
   pkg.load_from_json('configs/components/ruby-augeas.json')
-  pkg.build_requires "ruby-#{settings[:ruby_version]}"
+  pkg.build_requires(platform.is_archlinux? ? 'ruby' : "ruby-#{settings[:ruby_version]}")
   pkg.build_requires 'augeas'
 
   pkg.environment 'PATH', '$(PATH):/usr/local/bin:/opt/csw/bin:/usr/ccs/bin:/usr/sfw/bin'
   pkg.environment 'CONFIGURE_ARGS', '--vendor'
   pkg.environment 'PKG_CONFIG_PATH', "#{File.join(settings[:libdir], 'pkgconfig')}:/usr/lib/pkgconfig"
 
-  ruby = File.join(settings[:ruby_bindir], 'ruby')
+  ruby = settings[:host_ruby]
 
   if platform.is_macos?
     pkg.environment 'PATH', '$(PATH):/opt/homebrew/bin' if platform.architecture == 'arm64'
diff --git a/configs/components/ruby-selinux.rb b/configs/components/ruby-selinux.rb
index d68a2b75..888554a6 100644
--- a/configs/components/ruby-selinux.rb
+++ b/configs/components/ruby-selinux.rb
@@ -69,9 +69,9 @@
   pkg.add_source('file://resources/patches/ruby-selinux/selinuxswig_ruby_undefining_allocator.patch')
   pkg.add_source('file://resources/patches/ruby-selinux/undefining_allocator_el_7.patch')
 
-  pkg.build_requires "ruby-#{settings[:ruby_version]}"
+  pkg.build_requires(platform.is_archlinux? ? 'ruby' : "ruby-#{settings[:ruby_version]}")
   system_include = '-I/usr/include'
-  ruby = "#{settings[:ruby_bindir]}/ruby -rrbconfig"
+  ruby = "#{settings[:host_ruby]} -rrbconfig"
 
   # The RHEL 9 libselinux-devel package provides headers, but we don't want to
   # use the package becuase of a compatibility issue with the shared library.
diff --git a/configs/components/ruby-shadow-patched.rb b/configs/components/ruby-shadow-patched.rb
index 7a7252a4..89a60ad7 100644
--- a/configs/components/ruby-shadow-patched.rb
+++ b/configs/components/ruby-shadow-patched.rb
@@ -10,7 +10,7 @@
 component 'ruby-shadow-patched' do |pkg, settings, platform|
   pkg.load_from_json('configs/components/ruby-shadow-patched.json')
 
-  pkg.build_requires "ruby-#{settings[:ruby_version]}"
+  pkg.build_requires(platform.is_archlinux? ? 'ruby' : "ruby-#{settings[:ruby_version]}")
 
   pkg.environment 'CONFIGURE_ARGS', '--vendor'
 
@@ -18,7 +18,7 @@
     pkg.environment 'RUBY', settings[:host_ruby]
     ruby = "#{settings[:host_ruby]} -r#{settings[:datadir]}/doc/rbconfig-#{settings[:ruby_version]}-orig.rb"
   else
-    ruby = File.join(settings[:ruby_bindir], 'ruby')
+    ruby = settings[:host_ruby]
   end
 
   pkg.build do
diff --git a/configs/components/ruby-shadow.rb b/configs/components/ruby-shadow.rb
index 953ed4c9..3735201e 100644
--- a/configs/components/ruby-shadow.rb
+++ b/configs/components/ruby-shadow.rb
@@ -6,12 +6,12 @@
 component 'ruby-shadow' do |pkg, settings, platform|
   pkg.load_from_json('configs/components/ruby-shadow.json')
 
-  pkg.build_requires "ruby-#{settings[:ruby_version]}"
+  pkg.build_requires(platform.is_archlinux? ? 'ruby' : "ruby-#{settings[:ruby_version]}")
   pkg.environment 'PATH', '$(PATH):/usr/ccs/bin:/usr/sfw/bin'
 
   pkg.environment 'CONFIGURE_ARGS', '--vendor'
 
-  ruby = File.join(settings[:ruby_bindir], 'ruby')
+  ruby = settings[:host_ruby]
 
   base = 'resources/patches/ruby_32'
   # https://github.com/apalmblad/ruby-shadow/issues/26
diff --git a/configs/platforms/archlinux-rolling-x86_64.rb b/configs/platforms/archlinux-rolling-x86_64.rb
new file mode 100644
index 00000000..9901f7c6
--- /dev/null
+++ b/configs/platforms/archlinux-rolling-x86_64.rb
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+platform 'archlinux-rolling-x86_64' do |plat|
+  plat.inherit_from_default
+end
diff --git a/configs/projects/openbolt-runtime.rb b/configs/projects/openbolt-runtime.rb
index 2b8ea99e..45660af5 100644
--- a/configs/projects/openbolt-runtime.rb
+++ b/configs/projects/openbolt-runtime.rb
@@ -35,7 +35,11 @@
     proj.setting(:prefix, '/opt/puppetlabs/bolt')
   end
 
-  ruby_base_version = proj.ruby_version.gsub(/(\d+)\.(\d+)(\.\d+)?/, '\1.\2.0')
+  ruby_base_version = if platform.is_archlinux?
+                        '3.4.0'
+                      else
+                        proj.ruby_version.gsub(/(\d+)\.(\d+)(\.\d+)?/, '\1.\2.0')
+                      end
 
   proj.setting(:ruby_dir, proj.prefix)
   proj.setting(:bindir, File.join(proj.prefix, 'bin'))
@@ -57,11 +61,12 @@
     platform_triple = platform.platform_triple
     host = "--host #{platform_triple}"
   else
-    proj.setting(:host_ruby, File.join(proj.ruby_bindir, 'ruby'))
-    proj.setting(:host_gem, File.join(proj.ruby_bindir, 'gem'))
+    proj.setting(:host_ruby, platform.is_archlinux? ? '/usr/bin/ruby' : File.join(proj.ruby_bindir, 'ruby'))
+    proj.setting(:host_gem, platform.is_archlinux? ? '/usr/bin/gem' : File.join(proj.ruby_bindir, 'gem'))
   end
 
   proj.setting(:gem_home, File.join(proj.libdir, 'ruby', 'gems', ruby_base_version))
+  proj.setting(:system_gem_path, '/usr/lib/ruby/gems/3.4.0') if platform.is_archlinux?
   proj.setting(:gem_install, "#{proj.host_gem} install --no-document --local --bindir=#{proj.ruby_bindir}")
 
   proj.setting(:platform_triple, platform_triple)