diff --git a/.rubocop.yml b/.rubocop.yml
index d2ab95d2..c43722ac 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -1,7 +1,7 @@
 # This file is based on https://github.com/rails/rails/blob/master/.rubocop.yml (MIT license)
 # Automatically generated by OpenAPI Generator (https://openapi-generator.tech)
 AllCops:
-  TargetRubyVersion: 2.4
+  TargetRubyVersion: 3.2
   # RuboCop has a bunch of cops enabled by default. This setting tells RuboCop
   # to ignore them, so only the ones explicitly set in this file are enabled.
   DisabledByDefault: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..f2e4b380
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,34 @@
+# Changelog
+
+Notable changes to xero-ruby are recorded here.
+
+## Unreleased
+
+### Changed (breaking)
+
+- Raised `required_ruby_version` in `xero-ruby.gemspec` from `>= 2.3` to `>= 3.2`.
+  Ruby 2.3 through 3.1 are no longer supported.
+
+  Applications still on those versions are left on 18.1.0. RubyGems resolves a
+  consumer to the newest release whose `required_ruby_version` they satisfy, so
+  `bundle update xero-ruby` quietly holds them at 18.1.0 rather than failing, and
+  they stop receiving fixes with no error to signal it. Upgrade to Ruby 3.2 or
+  later to keep receiving updates.
+
+- Raised `TargetRubyVersion` in `.rubocop.yml` from 2.4 to 3.2 to match the new
+  floor. It previously contradicted the gemspec, so syntax that is valid on the
+  supported floor (endless method definitions, `...` argument forwarding) would
+  raise a `Lint/Syntax` offence in the CI lint step on correct code.
+
+### Notes for maintainers
+
+Dropping supported Ruby versions is a breaking change, so the next release must
+be cut as **19.0.0**, not 18.2.0.
+
+`lib/xero-ruby/version.rb` is deliberately left at 18.1.0 in this change. That
+file is OpenAPI-Generator-owned and its version is stamped by the
+`Releasing X.Y.Z (OAS: N.N.N)` commit produced by the codegen pipeline, not by
+feature pull requests, and `.github/workflows/publish.yml` publishes whatever
+version that file carries at release time. Bumping it here would collide with
+that pipeline, so the major bump is recorded as a release requirement instead of
+being applied in this change.
diff --git a/xero-ruby.gemspec b/xero-ruby.gemspec
index 2662de90..87edc4f5 100644
--- a/xero-ruby.gemspec
+++ b/xero-ruby.gemspec
@@ -24,7 +24,7 @@ Gem::Specification.new do |s|
   s.summary     = "Xero Accounting API Ruby Gem"
   s.description = "Xero API OAuth2.0 SDK - Ruby Gem"
   s.license     = "Unlicense"
-  s.required_ruby_version = ">= 2.3"
+  s.required_ruby_version = ">= 3.2"
 
   s.add_runtime_dependency 'faraday', '>= 2.0', '< 3.0'
   s.add_runtime_dependency 'json', '~> 2.1', '>= 2.1.0'