diff --git a/Gemfile b/Gemfile
index 37985b608..56e293d2a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -35,6 +35,11 @@ gem 'jwt'
 # vips backend is never loaded.
 gem 'image_processing'
 gem 'mini_magick'
+# json 3.0 breaks ActiveSupport::JSON.decode: json 3.0 made JSON.parse
+# keyword-only, so Rails' JSON.parse(json, options) positional-hash call
+# raises ArgumentError and every session-cookie read fails. Pinned until
+# Rails supports json 3.x (https://github.com/codebar/planner/pull/2864).
+gem 'json', '~> 2.3'
 gem 'mutex_m' # LOCKED: Added because of activesupport 7.0
 gem 'nokogiri'
 gem 'omniauth'
diff --git a/Gemfile.lock b/Gemfile.lock
index 3d7447274..fdb77c2a4 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -662,6 +662,7 @@ DEPENDENCIES
   image_processing
   irb
   jquery-rails
+  json (~> 2.3)
   jwt
   launchy
   letter_opener