diff --git a/Gemfile b/Gemfile
index 21003fc..c158cd0 100644
--- a/Gemfile
+++ b/Gemfile
@@ -53,7 +53,7 @@ end
 gem "jb"
 gem "pry-rails", group: :development
 gem "awesome_print"
-gem "dotenv-rails", groups: [:development, :test]
+gem "dotenv-rails", groups: [ :development, :test ]
 gem "hashid-rails"
 gem "vite_rails"
 gem "phlex-rails"
diff --git a/app/components/admin/users/show.rb b/app/components/admin/users/show.rb
index 04ae13b..89f783e 100644
--- a/app/components/admin/users/show.rb
+++ b/app/components/admin/users/show.rb
@@ -100,7 +100,7 @@ class Components::Admin::Users::Show < Components::Base
             end
             # Progress bar
             div(style: "background: var(--bgColor-muted); border-radius: 3px; height: 8px; overflow: hidden;") do
-              div(style: "background: #{progress_bar_color(usage[:percentage_used])}; height: 100%; width: #{[usage[:percentage_used], 100].min}%;")
+              div(style: "background: #{progress_bar_color(usage[:percentage_used])}; height: 100%; width: #{[ usage[:percentage_used], 100 ].min}%;")
             end
           end
 
diff --git a/app/components/header_bar.rb b/app/components/header_bar.rb
index 7ad21fe..bb25891 100644
--- a/app/components/header_bar.rb
+++ b/app/components/header_bar.rb
@@ -25,7 +25,6 @@ class Components::HeaderBar < Components::Base
 
       return unless signed_in?
       div(style: "display: flex; align-items: center; gap: 0.5rem;") do
-
         render(Primer::Alpha::ActionMenu.new(anchor_align: :end)) do |menu|
           menu.with_show_button(scheme: :invisible) do |btn|
             btn.with_leading_visual_icon(icon: impersonating? ? :eye : :person)
diff --git a/app/components/static_pages/home.rb b/app/components/static_pages/home.rb
index f325416..005de57 100644
--- a/app/components/static_pages/home.rb
+++ b/app/components/static_pages/home.rb
@@ -115,7 +115,7 @@ class Components::StaticPages::Home < Components::StaticPages::Base
       end
       # Progress bar
       div(style: "background: var(--bgColor-muted); border-radius: 3px; height: 6px; overflow: hidden;") do
-        div(style: "background: #{progress_color}; height: 100%; width: #{[percentage, 100].min}%;")
+        div(style: "background: #{progress_color}; height: 100%; width: #{[ percentage, 100 ].min}%;")
       end
     end
   end
diff --git a/app/controllers/admin/application_controller.rb b/app/controllers/admin/application_controller.rb
index df3d21f..9358d9e 100644
--- a/app/controllers/admin/application_controller.rb
+++ b/app/controllers/admin/application_controller.rb
@@ -11,4 +11,4 @@ module Admin
       ) unless current_user&.is_admin?
     end
   end
-end
\ No newline at end of file
+end
diff --git a/app/controllers/api/v4/application_controller.rb b/app/controllers/api/v4/application_controller.rb
index 3e2bb55..0bc02ce 100644
--- a/app/controllers/api/v4/application_controller.rb
+++ b/app/controllers/api/v4/application_controller.rb
@@ -50,4 +50,4 @@ module API
       end
     end
   end
-end
\ No newline at end of file
+end
diff --git a/app/controllers/api/v4/uploads_controller.rb b/app/controllers/api/v4/uploads_controller.rb
index 3051181..13f716d 100644
--- a/app/controllers/api/v4/uploads_controller.rb
+++ b/app/controllers/api/v4/uploads_controller.rb
@@ -3,7 +3,7 @@
 module API
   module V4
     class UploadsController < ApplicationController
-      before_action :check_quota, only: [:create, :create_from_url]
+      before_action :check_quota, only: [ :create, :create_from_url ]
 
       # POST /api/v4/upload
       def create
@@ -75,7 +75,7 @@ module API
           unless quota_service.can_upload?(file_size)
             usage = quota_service.current_usage
             render json: quota_error_json(usage), status: :payment_required
-            return
+            nil
           end
         end
         # For URL uploads, quota is checked after download in create_from_url
diff --git a/app/controllers/api_keys_controller.rb b/app/controllers/api_keys_controller.rb
index 517592a..a3e3a6c 100644
--- a/app/controllers/api_keys_controller.rb
+++ b/app/controllers/api_keys_controller.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class APIKeysController < ApplicationController
-  before_action :set_api_key, only: [:destroy]
+  before_action :set_api_key, only: [ :destroy ]
 
   def index
     @api_keys = current_user.api_keys.active.recent
diff --git a/app/controllers/static_pages_controller.rb b/app/controllers/static_pages_controller.rb
index 75b21fb..7780baa 100644
--- a/app/controllers/static_pages_controller.rb
+++ b/app/controllers/static_pages_controller.rb
@@ -1,5 +1,5 @@
 class StaticPagesController < ApplicationController
-  skip_before_action :require_authentication!, only: [:home]
+  skip_before_action :require_authentication!, only: [ :home ]
 
   def home
     @flavor_text = FlavorTextService.new(user: current_user).generate
diff --git a/app/controllers/uploads_controller.rb b/app/controllers/uploads_controller.rb
index dc0843b..8e4abeb 100644
--- a/app/controllers/uploads_controller.rb
+++ b/app/controllers/uploads_controller.rb
@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 class UploadsController < ApplicationController
-  before_action :set_upload, only: [:destroy]
-  before_action :check_quota, only: [:create]
+  before_action :set_upload, only: [ :destroy ]
+  before_action :check_quota, only: [ :create ]
 
   def index
     @uploads = current_user.uploads.includes(:blob).recent
@@ -67,7 +67,7 @@ class UploadsController < ApplicationController
     unless quota_service.can_upload?(file_size)
       usage = quota_service.current_usage
       redirect_to uploads_path, alert: "Uploading this file would exceed your storage quota. You're using #{ActiveSupport::NumberHelper.number_to_human_size(usage[:storage_used])} of #{ActiveSupport::NumberHelper.number_to_human_size(usage[:storage_limit])}."
-      return
+      nil
     end
   end
 
diff --git a/app/models/application_record.rb b/app/models/application_record.rb
index 617a8f7..1decbca 100644
--- a/app/models/application_record.rb
+++ b/app/models/application_record.rb
@@ -6,7 +6,7 @@ class ApplicationRecord < ActiveRecord::Base
   private
 
   def generate_uuid_v7
-    return if self.class.attribute_types['id'].type != :uuid
+    return if self.class.attribute_types["id"].type != :uuid
     self.id ||= SecureRandom.uuid_v7
   end
 end
diff --git a/app/models/doc_page.rb b/app/models/doc_page.rb
index 8f5f8e6..6e76724 100644
--- a/app/models/doc_page.rb
+++ b/app/models/doc_page.rb
@@ -53,10 +53,10 @@ class DocPage
         parts = content.split("---", 3)
         if parts.length >= 3
           frontmatter = YAML.safe_load(parts[1]) || {}
-          return [frontmatter, parts[2].strip]
+          return [ frontmatter, parts[2].strip ]
         end
       end
-      [{}, content]
+      [ {}, content ]
     end
 
     def render_markdown(content)
diff --git a/app/models/quota.rb b/app/models/quota.rb
index fcb8683..edaaae7 100644
--- a/app/models/quota.rb
+++ b/app/models/quota.rb
@@ -4,8 +4,8 @@ class Quota
   ALL_POLICIES = [
     Policy[:unverified, 10.megabytes, 50.megabytes],
     Policy[:verified, 50.megabytes, 50.gigabytes],
-    Policy[:functionally_unlimited, 200.megabytes, 300.gigabytes],
+    Policy[:functionally_unlimited, 200.megabytes, 300.gigabytes]
   ].index_by &:slug
 
   def self.policy(slug) = ALL_POLICIES.fetch slug
-end
\ No newline at end of file
+end
diff --git a/app/models/upload.rb b/app/models/upload.rb
index a27431b..778b78a 100644
--- a/app/models/upload.rb
+++ b/app/models/upload.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'open-uri'
+require "open-uri"
 
 class Upload < ApplicationRecord
   include PgSearch::Model
@@ -8,7 +8,7 @@ class Upload < ApplicationRecord
   # UUID v7 primary key (automatic via migration)
 
   belongs_to :user
-  belongs_to :blob, class_name: 'ActiveStorage::Blob'
+  belongs_to :blob, class_name: "ActiveStorage::Blob"
 
   after_destroy :purge_blob
 
@@ -25,10 +25,10 @@ class Upload < ApplicationRecord
     }
 
   pg_search_scope :search,
-    against: [:original_url],
+    against: [ :original_url ],
     associated_against: {
       blob: :filename,
-      user: [:email, :name]
+      user: [ :email, :name ]
     },
     using: { tsearch: { prefix: true } }
 
@@ -38,19 +38,19 @@ class Upload < ApplicationRecord
 
   # Provenance enum
   enum :provenance, {
-    slack: 'slack',
-    web: 'web',
-    api: 'api',
-    rescued: 'rescued'
+    slack: "slack",
+    web: "web",
+    api: "api",
+    rescued: "rescued"
   }, validate: true
 
   validates :provenance, presence: true
 
   scope :recent, -> { order(created_at: :desc) }
   scope :by_user, ->(user) { where(user: user) }
-  scope :today, -> { where('created_at >= ?', Time.zone.now.beginning_of_day) }
-  scope :this_week, -> { where('created_at >= ?', Time.zone.now.beginning_of_week) }
-  scope :this_month, -> { where('created_at >= ?', Time.zone.now.beginning_of_month) }
+  scope :today, -> { where("created_at >= ?", Time.zone.now.beginning_of_day) }
+  scope :this_week, -> { where("created_at >= ?", Time.zone.now.beginning_of_week) }
+  scope :this_month, -> { where("created_at >= ?", Time.zone.now.beginning_of_month) }
 
   def human_file_size
     ActiveSupport::NumberHelper.number_to_human_size(byte_size)
@@ -61,7 +61,7 @@ class Upload < ApplicationRecord
     Rails.application.routes.url_helpers.external_upload_url(
       id:,
       filename:,
-      host: ENV['CDN_HOST'] || 'cdn.hackclub.com'
+      host: ENV["CDN_HOST"] || "cdn.hackclub.com"
     )
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 996421b..960e0d3 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -7,7 +7,7 @@ class User < ApplicationRecord
   def to_param = public_id
 
   pg_search_scope :search,
-    against: [:email, :name, :slack_id],
+    against: [ :email, :name, :slack_id ],
     using: { tsearch: { prefix: true } }
 
   scope :admins, -> { where(is_admin: true) }
@@ -16,7 +16,7 @@ class User < ApplicationRecord
   encrypts :hca_access_token
 
   has_many :uploads, dependent: :destroy
-  has_many :api_keys, dependent: :destroy, class_name: 'APIKey'
+  has_many :api_keys, dependent: :destroy, class_name: "APIKey"
 
   def self.find_or_create_from_omniauth(auth)
     hca_id = auth.uid
@@ -53,7 +53,7 @@ class User < ApplicationRecord
   end
 
   def total_storage_bytes
-    uploads.joins(:blob).sum('active_storage_blobs.byte_size')
+    uploads.joins(:blob).sum("active_storage_blobs.byte_size")
   end
 
   def total_storage_gb
diff --git a/app/services/cdn_stats_service.rb b/app/services/cdn_stats_service.rb
index 53e49e3..f393b24 100644
--- a/app/services/cdn_stats_service.rb
+++ b/app/services/cdn_stats_service.rb
@@ -26,7 +26,7 @@ class CDNStatsService
     used = usage[:storage_used]
     max = usage[:storage_limit]
     percentage = usage[:percentage_used]
-    available = [max - used, 0].max
+    available = [ max - used, 0 ].max
 
     {
       total_files: user.total_files,
@@ -50,7 +50,7 @@ class CDNStatsService
 
   def self.calculate_global_stats
     total_files = Upload.count
-    total_storage_bytes = Upload.joins(:blob).sum('active_storage_blobs.byte_size')
+    total_storage_bytes = Upload.joins(:blob).sum("active_storage_blobs.byte_size")
     total_users = User.joins(:uploads).distinct.count
 
     {
diff --git a/app/services/flavor_text_service.rb b/app/services/flavor_text_service.rb
index e110ab4..66bdc4d 100644
--- a/app/services/flavor_text_service.rb
+++ b/app/services/flavor_text_service.rb
@@ -167,7 +167,7 @@ class FlavorTextService
       "low-sodium edition",
       'we put the ":3" in "S3"!',
       "do not adjust your monitor.",
-      "only #{@random.rand(5..50)} missing #{["file", "files"].sample(random: @random)}!",
+      "only #{@random.rand(5..50)} missing #{[ "file", "files" ].sample(random: @random)}!",
       "why are you reading these",
       "go outside",
       "posture check!",
@@ -229,7 +229,7 @@ class FlavorTextService
       "100% bug-free* *no it's not",
       "who let me cook",
       "cooked (derogatory)",
-      "this seemed like a good idea at the time",
+      "this seemed like a good idea at the time"
     ]
   end
 
@@ -238,4 +238,4 @@ class FlavorTextService
   def sample
     flavor_texts.sample(random: @random)
   end
-end
\ No newline at end of file
+end
diff --git a/config/application.rb b/config/application.rb
index 88286cb..75f4423 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -8,7 +8,6 @@ Bundler.require(*Rails.groups)
 
 module CDN
   class Application < Rails::Application
-
     require "view_component"
     require "primer/view_components"
 
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 3fcbf55..c5d3346 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -34,7 +34,7 @@ Rails.application.configure do
   # config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } }
 
   # Log to STDOUT with the current request id as a default log tag.
-  config.log_tags = [:request_id]
+  config.log_tags = [ :request_id ]
   config.logger = ActiveSupport::TaggedLogging.logger(STDOUT)
 
   # Change to "debug" to log everything (including potentially personally-identifiable information!)
@@ -77,7 +77,7 @@ Rails.application.configure do
   config.active_record.dump_schema_after_migration = false
 
   # Only use :id for inspections in production.
-  config.active_record.attributes_for_inspect = [:id]
+  config.active_record.attributes_for_inspect = [ :id ]
 
   # Enable DNS rebinding protection and other `Host` header attacks.
   # config.hosts = [
diff --git a/config/initializers/blind_index.rb b/config/initializers/blind_index.rb
index ff33367..8ea72e3 100644
--- a/config/initializers/blind_index.rb
+++ b/config/initializers/blind_index.rb
@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-BlindIndex.master_key = ENV.fetch('BLIND_INDEX_MASTER_KEY')
+BlindIndex.master_key = ENV.fetch("BLIND_INDEX_MASTER_KEY")
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 1ac72ff..5c02038 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -11,10 +11,10 @@
 #     policy.img_src     :self, :https, :data
 #     policy.object_src  :none
 #     policy.script_src  :self, :https
-    # Allow @vite/client to hot reload javascript changes in development
+# Allow @vite/client to hot reload javascript changes in development
 #    policy.script_src *policy.script_src, :unsafe_eval, "http://#{ ViteRuby.config.host_with_port }" if Rails.env.development?
 
-    # You may need to enable this in production as well depending on your setup.
+# You may need to enable this in production as well depending on your setup.
 #    policy.script_src *policy.script_src, :blob if Rails.env.test?
 
 # Allow @vite/client to hot reload javascript changes in development
@@ -24,7 +24,7 @@
 #    policy.script_src *policy.script_src, :blob if Rails.env.test?
 
 #     policy.style_src   :self, :https
-    # Allow @vite/client to hot reload style changes in development
+# Allow @vite/client to hot reload style changes in development
 #    policy.style_src *policy.style_src, :unsafe_inline if Rails.env.development?
 
 # Allow @vite/client to hot reload style changes in development
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
index ee2ed8c..c0b717f 100644
--- a/config/initializers/filter_parameter_logging.rb
+++ b/config/initializers/filter_parameter_logging.rb
@@ -4,5 +4,5 @@
 # Use this to limit dissemination of sensitive information.
 # See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
 Rails.application.config.filter_parameters += [
-  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc,
+  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc
 ]
diff --git a/config/initializers/lockbox.rb b/config/initializers/lockbox.rb
index c526a5e..7f89ac6 100644
--- a/config/initializers/lockbox.rb
+++ b/config/initializers/lockbox.rb
@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-Lockbox.master_key = ENV.fetch('LOCKBOX_MASTER_KEY')
+Lockbox.master_key = ENV.fetch("LOCKBOX_MASTER_KEY")
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index cef3bf4..490b27e 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -5,5 +5,5 @@ Rails.application.config.middleware.use OmniAuth::Builder do
     scope: "openid email name slack_id verification_status",
     staging: !Rails.env.production?
 end
-OmniAuth.config.allowed_request_methods = [:post]
+OmniAuth.config.allowed_request_methods = [ :post ]
 OmniAuth.config.request_validation_phase = OmniAuth::AuthenticityTokenProtection.new(key: :_csrf_token)
diff --git a/config/initializers/sentry.rb b/config/initializers/sentry.rb
index c5ce369..a56e2e8 100644
--- a/config/initializers/sentry.rb
+++ b/config/initializers/sentry.rb
@@ -1,6 +1,6 @@
 Sentry.init do |config|
   config.dsn = ENV["SENTRY_DSN"]
-  config.breadcrumbs_logger = [:active_support_logger, :http_logger]
+  config.breadcrumbs_logger = [ :active_support_logger, :http_logger ]
   config.traces_sample_rate = 0.1
   config.send_default_pii = false
   config.enabled_environments = %w[production staging]
diff --git a/config/routes.rb b/config/routes.rb
index 0716d59..3ffabb6 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,13 +1,13 @@
 Rails.application.routes.draw do
   namespace :admin do
     get "search", to: "search#index"
-    resources :users, only: [:show, :destroy] do
+    resources :users, only: [ :show, :destroy ] do
       member do
         patch "set_quota"
       end
     end
-    resources :uploads, only: [:destroy]
-    resources :api_keys, only: [:destroy]
+    resources :uploads, only: [ :destroy ]
+    resources :api_keys, only: [ :destroy ]
   end
 
   delete "/logout", to: "sessions#destroy", as: :logout
@@ -17,9 +17,9 @@ Rails.application.routes.draw do
   get "/auth/hack_club/callback", to: "sessions#create"
   get "/auth/failure", to: "sessions#failure"
 
-  resources :uploads, only: [:index, :create, :destroy]
+  resources :uploads, only: [ :index, :create, :destroy ]
 
-  resources :api_keys, only: [:index, :create, :destroy]
+  resources :api_keys, only: [ :index, :create, :destroy ]
 
   namespace :api do
     namespace :v4 do
diff --git a/db/migrate/20260129051531_create_uploads.rb b/db/migrate/20260129051531_create_uploads.rb
index 5214f2c..a5cdfb6 100644
--- a/db/migrate/20260129051531_create_uploads.rb
+++ b/db/migrate/20260129051531_create_uploads.rb
@@ -12,7 +12,7 @@ class CreateUploads < ActiveRecord::Migration[8.0]
 
       t.timestamps
 
-      t.index [:user_id, :created_at]
+      t.index [ :user_id, :created_at ]
       t.index :created_at
       t.index :provenance
     end
diff --git a/db/migrate/20260129201832_create_api_keys.rb b/db/migrate/20260129201832_create_api_keys.rb
index 92cdef4..557e8da 100644
--- a/db/migrate/20260129201832_create_api_keys.rb
+++ b/db/migrate/20260129201832_create_api_keys.rb
@@ -10,7 +10,7 @@ class CreateAPIKeys < ActiveRecord::Migration[8.0]
       t.timestamps
 
       t.index :token_bidx, unique: true
-      t.index [:user_id, :revoked]
+      t.index [ :user_id, :revoked ]
     end
   end
 end
diff --git a/db/seeds.rb b/db/seeds.rb
index 55ff71f..c1f61c8 100644
--- a/db/seeds.rb
+++ b/db/seeds.rb
@@ -15,7 +15,7 @@ if Rails.env.development?
     name: 'Dev User'
   )
 
-  provenances = [:web, :api, :slack, :rescued]
+  provenances = [ :web, :api, :slack, :rescued ]
 
   10.times do |i|
     # Create dummy file content
diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb
index 33264b9..cee29fd 100644
--- a/test/application_system_test_case.rb
+++ b/test/application_system_test_case.rb
@@ -1,5 +1,5 @@
 require "test_helper"
 
 class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
-  driven_by :selenium, using: :headless_chrome, screen_size: [1400, 1400]
+  driven_by :selenium, using: :headless_chrome, screen_size: [ 1400, 1400 ]
 end
diff --git a/test/controllers/api/v4/uploads_controller_test.rb b/test/controllers/api/v4/uploads_controller_test.rb
index 003c080..18e2408 100644
--- a/test/controllers/api/v4/uploads_controller_test.rb
+++ b/test/controllers/api/v4/uploads_controller_test.rb
@@ -82,7 +82,7 @@ class API::V4::UploadsControllerTest < ActionDispatch::IntegrationTest
     url = "https://example.com/broken.jpg"
 
     # Simulate an error
-    URI.stub :open, -> (_) { raise StandardError, "Network error" } do
+    URI.stub :open, ->(_) { raise StandardError, "Network error" } do
       post api_v4_upload_from_url_url,
         params: { url: url }.to_json,
         headers: {