diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b2759979f3d..a6b11853a02 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
   rubocop:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/sparklemotion/nokogiri-test:mri-3.2
+      image: ghcr.io/sparklemotion/nokogiri-test:mri-3.3
     steps:
       - uses: actions/checkout@v4
         with:
@@ -69,7 +69,7 @@ jobs:
           submodules: true
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.3"
           bundler-cache: true
           bundler: latest
       - run: bundle exec rake gumbo:test
@@ -98,7 +98,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["enable", "disable"]
-        ruby: ["3.0", "3.1", "3.2", "3.3-rc"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: ubuntu-latest
     container:
       image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}}
@@ -122,11 +122,11 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["enable", "disable"]
-        ruby: ["3.0", "3.1", "3.2"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
         mem: ["ruby"]
         include:
           - sys: "disable"
-            ruby: "3.2"
+            ruby: "3.3"
             mem: "default"
     runs-on: ubuntu-latest
     container:
@@ -188,7 +188,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["enable"]
-        ruby: ["3.2"]
+        ruby: ["3.3"]
     env:
       BUNDLE_GEMFILE: "Gemfile-libxml-ruby"
     runs-on: ubuntu-latest
@@ -213,7 +213,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["disable"]
-        ruby: ["3.2"]
+        ruby: ["3.3"]
     env:
       BUNDLE_GEMFILE: "Gemfile-libxml-ruby"
     runs-on: ubuntu-latest
@@ -238,7 +238,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["enable", "disable"]
-        ruby: ["3.0", "3.1", "3.2", "3.3.0-rc1"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
@@ -263,7 +263,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["enable", "disable"]
-        ruby: ["3.0", "3.1", "3.2", "head", "mingw"]
+        ruby: ["3.0", "3.1", "3.2", "3.3", "mingw"]
     runs-on: windows-2022
     steps:
       - name: configure git crlf
@@ -364,7 +364,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["disable"]
-        ruby: ["3.2"]
+        ruby: ["3.3"]
     runs-on: ubuntu-latest
     container:
       image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}}
@@ -387,7 +387,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["disable"]
-        ruby: ["3.2"]
+        ruby: ["3.3"]
     runs-on: ubuntu-latest
     container:
       image: ghcr.io/sparklemotion/nokogiri-test:mri-${{matrix.ruby}}
@@ -416,7 +416,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.3"
           bundler-cache: true
           bundler: latest
       - id: rcd_image_version
@@ -452,7 +452,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["enable", "disable"]
-        ruby: ["3.0", "3.1", "3.2", "head"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -474,7 +474,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["enable", "disable"]
-        ruby: ["3.0", "3.1", "3.2", "head"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
@@ -518,7 +518,7 @@ jobs:
       fail-fast: false
       matrix:
         sys: ["enable", "disable"]
-        ruby: ["3.1", "3.2", "head"]
+        ruby: ["3.1", "3.2", "3.3"]
     runs-on: windows-2022
     steps:
       - uses: actions/checkout@v4
@@ -577,7 +577,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ["3.0", "3.1", "3.2", "3.3.0-rc1"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -599,7 +599,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ["3.0", "3.1", "3.2", "3.3.0-rc1"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -621,7 +621,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ["3.0", "3.1", "3.2", "3.3.0-rc1"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -643,7 +643,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ["3.0", "3.1", "3.2", "head"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -680,7 +680,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ["3.0", "3.1", "3.2", "head"]
+        ruby: ["3.0", "3.1", "3.2", "3.3"]
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v4
@@ -721,7 +721,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ["3.1", "3.2", "head"]
+        ruby: ["3.1", "3.2", "3.3"]
     runs-on: windows-2022
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/generate-ci-images.yml b/.github/workflows/generate-ci-images.yml
index d312864864e..8ce393c4424 100644
--- a/.github/workflows/generate-ci-images.yml
+++ b/.github/workflows/generate-ci-images.yml
@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        tag: ["alpine", "mri-3.0", "mri-3.1", "mri-3.2", "mri-3.3-rc", "truffle-nightly", "ubuntu"]
+        tag: ["alpine", "mri-3.0", "mri-3.1", "mri-3.2", "mri-3.3", "truffle-nightly", "ubuntu"]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index 197af4df0df..7822501b7eb 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -31,7 +31,7 @@ jobs:
           submodules: true
       - uses: ruby/setup-ruby-pkgs@v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.3"
           apt-get: "autogen libtool shtool"
           brew: "automake autogen libtool shtool"
           mingw: "autotools"
@@ -164,7 +164,7 @@ jobs:
   html5lib-tests:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/sparklemotion/nokogiri-test:mri-3.2
+      image: ghcr.io/sparklemotion/nokogiri-test:mri-3.3
     steps:
       - uses: actions/checkout@v4
         with:
@@ -172,7 +172,7 @@ jobs:
       - uses: actions/cache@v3
         with:
           path: ports
-          key: ports-ubuntu-3.2-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}}
+          key: ports-ubuntu-3.3-${{hashFiles('dependencies.yml', 'patches/**/*.patch', 'ext/nokogiri/extconf.rb')}}
       - name: Update html5lib-tests
         run: |
           cd test/html5lib-tests
diff --git a/oci-images/nokogiri-test/mri-3.3-rc.dockerfile b/oci-images/nokogiri-test/mri-3.3.dockerfile
similarity index 71%
rename from oci-images/nokogiri-test/mri-3.3-rc.dockerfile
rename to oci-images/nokogiri-test/mri-3.3.dockerfile
index caa766ef182..f7ef4ce905c 100644
--- a/oci-images/nokogiri-test/mri-3.3-rc.dockerfile
+++ b/oci-images/nokogiri-test/mri-3.3.dockerfile
@@ -1,4 +1,4 @@
-FROM ruby:3.3-rc
+FROM ruby:3.3
 
 # include_file debian-prelude.step
 # -*- dockerfile -*-
@@ -9,10 +9,16 @@ RUN apt-get upgrade -y
 RUN apt-get install -y apt-utils
 
 
-# include_file debian-valgrind.step
+# include_file valgrind-from-source.step
 # -*- dockerfile -*-
 
-RUN apt-get install -y valgrind
+RUN apt-get install -y libc6-dbg
+RUN wget https://sourceware.org/pub/valgrind/valgrind-3.21.0.tar.bz2 && \
+    tar -xf valgrind-3.21.0.tar.bz2 && \
+    cd valgrind-3.21.0 && \
+    ./configure && \
+    make && \
+    make install
 
 
 # include_file debian-libxml-et-al.step
diff --git a/oci-images/nokogiri-test/mri.erb b/oci-images/nokogiri-test/mri.erb
index 553666be3df..71e2134df04 100644
--- a/oci-images/nokogiri-test/mri.erb
+++ b/oci-images/nokogiri-test/mri.erb
@@ -2,7 +2,7 @@ FROM ruby:<%= version %>
 
 <%= include_file "debian-prelude.step" %>
 
-<% if version == "3.2" -%>
+<% if version >= "3.2" -%>
 <%= include_file "valgrind-from-source.step" %>
 <% else -%>
 <%= include_file "debian-valgrind.step" %>
diff --git a/rakelib/docker.rake b/rakelib/docker.rake
index 8cdb0ac524f..db155be1aa8 100644
--- a/rakelib/docker.rake
+++ b/rakelib/docker.rake
@@ -8,7 +8,7 @@ module DockerHelper
   IMAGE_DIR = "oci-images/nokogiri-test"
   IMAGE_NAME = "ghcr.io/sparklemotion/nokogiri-test"
   RUBIES = {
-    mri: ["3.0", "3.1", "3.2", "3.3-rc"],
+    mri: ["3.0", "3.1", "3.2", "3.3"],
     truffle: ["nightly"],
   }
 
@@ -74,14 +74,14 @@ module DockerHelper
                   ruby-version: "3.1"
                   bundler-cache: true
                   bundler: latest
-              - uses: docker/setup-buildx-action@v2
-              - uses: docker/login-action@v2
+              - uses: docker/setup-buildx-action@v3
+              - uses: docker/login-action@v3
                 with:
                   registry: ghcr.io
                   username: ${{github.actor}}
                   password: ${{secrets.GITHUB_TOKEN}}
               - name: ${{matrix.tag}}
-                uses: docker/build-push-action@v3
+                uses: docker/build-push-action@v5
                 with:
                   context: "."
                   push: true
diff --git a/test/xml/test_node_set.rb b/test/xml/test_node_set.rb
index 0d72530e38b..9ca385312ca 100644
--- a/test/xml/test_node_set.rb
+++ b/test/xml/test_node_set.rb
@@ -805,6 +805,7 @@ def awesome(ns)
           it "returns an enumerator given no block" do
             skip("enumerators confuse valgrind") if i_am_running_in_valgrind
             skip("enumerators confuse ASan") if i_am_running_with_asan
+            skip("https://bugs.ruby-lang.org/issues/20085") if RUBY_DESCRIPTION.include?("aarch64") && RUBY_VERSION == "3.3.0"
 
             employees = xml.search("//employee")
             enum = employees.each