diff --git a/Gemfile b/Gemfile
index 92787a491d..198110fbec 100644
--- a/Gemfile
+++ b/Gemfile
@@ -36,7 +36,7 @@ gem "mysql2"
 # gem "ruby-oci8" # only for CRuby users
 
 ## auth
-gem "cancancan", "3.1.0"
+gem "cancancan", "3.6.1"
 gem "devise"
 gem "devise-encryptable"
 gem "devise-security"
diff --git a/Gemfile.lock b/Gemfile.lock
index 57e9e6edf0..59ace90ec1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -192,7 +192,7 @@ GEM
       uniform_notifier (~> 1.11)
     byebug (13.0.0)
       reline (>= 0.6.0)
-    cancancan (3.1.0)
+    cancancan (3.6.1)
     capybara (3.40.0)
       addressable
       matrix
@@ -747,7 +747,7 @@ DEPENDENCIES
   bulk_email!
   bullet
   c2po!
-  cancancan (= 3.1.0)
+  cancancan (= 3.6.1)
   capybara
   capybara-email
   chosen-rails
diff --git a/config/initializers/cancancan.rb b/config/initializers/cancancan.rb
new file mode 100644
index 0000000000..e63c36fe13
--- /dev/null
+++ b/config/initializers/cancancan.rb
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+# CanCanCan 3.4+ makes rules defined on an STI subclass also match class-level
+# `can?` checks against the parent. If a rule targets an STI child (say OfflineReservation),
+# that rule now also matches when the check subject is the STI parent class (Reservation).
+StiDetector.singleton_class.prepend(Module.new do
+  def sti_class?(_subject)
+    false
+  end
+end)