diff --git a/Gemfile b/Gemfile
index b3f3b091aae..c168a247198 100644
--- a/Gemfile
+++ b/Gemfile
@@ -3,7 +3,7 @@ FOREMAN_GEMFILE = __FILE__ unless defined? FOREMAN_GEMFILE
 
 source 'https://rubygems.org'
 
-gem 'rails', '~> 6.1.6'
+gem 'rails', '~> 7.0.3'
 gem 'rest-client', '>= 2.0.0', '< 3', :require => 'rest_client'
 gem 'audited', '~> 5.0', '!= 5.1.0'
 gem 'will_paginate', '~> 3.3'
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index ad5d59b9c95..8cfbb9323b5 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -334,10 +334,6 @@ def process_ajax_error(exception, action = nil)
     render :partial => "common/ajax_error", :status => :internal_server_error, :locals => { :message => message }
   end
 
-  def redirect_back_or_to(url)
-    redirect_back(fallback_location: url, allow_other_host: false)
-  end
-
   def saved_redirect_url_or(default)
     session["redirect_to_url_#{controller_name}"] || default
   end
diff --git a/app/controllers/links_controller.rb b/app/controllers/links_controller.rb
index d9e2a940d13..41a6d3047c0 100644
--- a/app/controllers/links_controller.rb
+++ b/app/controllers/links_controller.rb
@@ -4,7 +4,7 @@ class LinksController < ApplicationController
 
   def show
     url = external_url(type: params[:type], options: params)
-    redirect_to(url)
+    redirect_to(url, allow_other_host: true)
   end
 
   def external_url(type:, options: {})
diff --git a/app/graphql/collection_loader.rb b/app/graphql/collection_loader.rb
index 07217ce4617..004e3134e11 100644
--- a/app/graphql/collection_loader.rb
+++ b/app/graphql/collection_loader.rb
@@ -41,7 +41,7 @@ def validate
   end
 
   def preloader_for_association(records)
-    ::ActiveRecord::Associations::Preloader.new.preload(records, association_name, base_scope).first
+    ::ActiveRecord::Associations::Preloader.new(records: records, associations: association_name, scope: base_scope).call.first
   end
 
   def read_association(preloader, record)
diff --git a/app/helpers/layout_helper.rb b/app/helpers/layout_helper.rb
index 90f762d51c8..fbafc8c49bc 100644
--- a/app/helpers/layout_helper.rb
+++ b/app/helpers/layout_helper.rb
@@ -159,7 +159,7 @@ def popover(title, msg, options = {})
 
   def icon_text(i, text = "", opts = {})
     opts[:kind] ||= "glyphicon"
-    (content_tag(:span, "", :class => "#{opts[:kind] + ' ' + opts[:kind]}-#{i} #{opts[:class]}", :title => opts[:title]) + " " + text).html_safe
+    (content_tag(:span, "", :class => "#{opts[:kind] + ' ' + opts[:kind]}-#{i} #{opts[:class]}", :title => opts[:title]) + " " + text.to_s).html_safe
   end
 
   def alert(opts = {})
diff --git a/app/models/concerns/hidden_value.rb b/app/models/concerns/hidden_value.rb
index be8cca69f7e..5dd951224b4 100644
--- a/app/models/concerns/hidden_value.rb
+++ b/app/models/concerns/hidden_value.rb
@@ -10,4 +10,8 @@ def safe_value
   def hidden_value
     HIDDEN_VALUE
   end
+
+  def hidden_value?
+    attributes['hidden_value']
+  end
 end
diff --git a/app/models/concerns/hostext/token.rb b/app/models/concerns/hostext/token.rb
index 910aa651222..37a4a44fcfd 100644
--- a/app/models/concerns/hostext/token.rb
+++ b/app/models/concerns/hostext/token.rb
@@ -5,7 +5,7 @@ module Token
     included do
       has_one :token, :foreign_key => :host_id, :dependent => :destroy, :inverse_of => :host, :class_name => 'Token::Build'
 
-      scope :for_token, ->(token) { joins(:token).where(:tokens => { :value => token }).where("expires >= ?", Time.now.utc.to_s(:db)).select('hosts.*') }
+      scope :for_token, ->(token) { joins(:token).where(:tokens => { :value => token }).where("expires >= ?", Time.now.utc.to_fs(:db)).select('hosts.*') }
       scope :for_token_when_built, ->(token) { joins(:token).where(:tokens => { :value => token }).select('hosts.*') }
 
       before_validation :refresh_token_on_build
diff --git a/app/models/host.rb b/app/models/host.rb
index 9713158cbe3..b134fa25b61 100644
--- a/app/models/host.rb
+++ b/app/models/host.rb
@@ -58,4 +58,9 @@ def self.respond_to_missing?(method, include_private = false)
     method.to_s =~ /\Afind_by_(.*)\Z/ || method.to_s.include?('create') ||
       [:reorder, :new].include?(method) || super
   end
+
+  # This is a workaround for https://github.com/rails/rails/blob/v7.0.4/activerecord/lib/active_record/reflection.rb#L420-L443
+  def self.<(other)
+    other == ActiveRecord::Base || super
+  end
 end
diff --git a/bundler.d/development.rb b/bundler.d/development.rb
index f17b5a2d91c..54723b87557 100644
--- a/bundler.d/development.rb
+++ b/bundler.d/development.rb
@@ -20,7 +20,7 @@
 
   gem 'bullet', '>= 6.1.0'
   gem "parallel_tests"
-  gem 'spring', '>= 1.0', '< 3'
+  gem 'spring', '~> 4.0'
   gem 'benchmark-ips', '>= 2.8.2'
   gem 'foreman'
   gem('bootsnap', :require => false)
diff --git a/config/application.rb b/config/application.rb
index 11344ec4841..54f82855d34 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -80,7 +80,7 @@ class Foreman::Consoletie < Rails::Railtie
 
 module Foreman
   class Application < Rails::Application
-    config.load_defaults '6.1'
+    config.load_defaults '7.0'
 
     # Rails 5.0 changed this to true, but a lot of code depends on this
     config.active_record.belongs_to_required_by_default = false
@@ -99,11 +99,13 @@ class Application < Rails::Application
     config.active_support.use_authenticated_message_encryption = false
     config.action_dispatch.use_authenticated_cookie_encryption = false
 
-    # Rails 6.0 changed this to :zeitwerk
-    config.autoloader = :zeitwerk
-
     # Rails 6.1 changed this to true, but apparently our codebase is not ready for bidirectional associations
     config.active_record.has_many_inversing = false
+
+    # Rails 7.0 changed this to true
+    config.active_record.verify_foreign_keys_for_fixtures = false
+    config.active_record.automatic_scope_inversing = false
+
     # Setup additional routes by loading all routes file from routes directory
     Dir["#{Rails.root}/config/routes/**/*.rb"].each do |route_file|
       config.paths['config/routes.rb'] << route_file
@@ -113,6 +115,8 @@ class Application < Rails::Application
     # Application configuration should go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded.
 
+    # Recommended by Rails: https://guides.rubyonrails.org/v7.0/configuring.html#config-add-autoload-paths-to-load-path
+    config.add_autoload_paths_to_load_path = false
     # Autoloading
     config.autoload_paths += %W(#{config.root}/app/models/auth_sources)
     config.autoload_paths += %W(#{config.root}/app/models/compute_resources)
diff --git a/test/factories/audit.rb b/test/factories/audit.rb
index 8f1f525df63..98674cd0708 100644
--- a/test/factories/audit.rb
+++ b/test/factories/audit.rb
@@ -1,7 +1,7 @@
 FactoryBot.define do
   factory :audit do
     sequence(:version) { |n| n.to_s }
-    auditable_type { "test" }
+    auditable_type { ApplicationRecord }
     action { "update" }
 
     trait :with_diff do
diff --git a/test/unit/has_many_common_test.rb b/test/unit/has_many_common_test.rb
index ba79aaed563..8947e46739f 100644
--- a/test/unit/has_many_common_test.rb
+++ b/test/unit/has_many_common_test.rb
@@ -92,7 +92,7 @@ class HasManyCommonTest < ActiveSupport::TestCase
 
   ## Test name methods resolve for Plugin AR objects
   class ::FakePlugin; end
-  class ::FakePlugin::FakeModel; end
+  class ::FakePlugin::FakeModel < ApplicationRecord; end
 
   test "should return plugin associations" do
     Host::Managed.class_eval do