diff --git a/Gemfile b/Gemfile
index 8561f8891..893c20a6e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -13,7 +13,7 @@ gem 'json'
 gem 'rails-observers'
 
 # core - application servers
-gem 'puma', group: :puma
+gem 'puma', '~>3.12', group: :puma
 gem 'unicorn', group: :unicorn
 
 # core - supported ORMs
diff --git a/Gemfile.lock b/Gemfile.lock
index 85d792eff..1532852ba 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -377,7 +377,7 @@ GEM
       binding_of_caller (>= 0.7)
       pry (>= 0.9.11)
     public_suffix (3.0.3)
-    puma (3.12.1)
+    puma (3.12.2)
     rack (2.0.7)
     rack-livereload (0.3.17)
       rack
@@ -624,7 +624,7 @@ DEPENDENCIES
   pry-remote
   pry-rescue
   pry-stack_explorer
-  puma
+  puma (~> 3.12)
   rack-livereload
   rails (= 5.2.3)
   rails-controller-testing