diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd4ac1ce9..f9d5f8a4d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -74,9 +74,9 @@ jobs:
         #- os: ubuntu-latest
         #  ruby: '3.3'
         #  asciidoctor-version: '~> 2.0.0'
-        #- os: ubuntu-latest
-        #  ruby: '3.3'
-        #  upstream: upstream
+        - os: ubuntu-latest
+          ruby: '3.3'
+          upstream: upstream
         - os: ubuntu-latest
           ruby: '3.3'
           rouge-version: '~> 4.0.0'
@@ -149,7 +149,6 @@ jobs:
       if: matrix.upstream
       run: |
         bundle exec ruby scripts/switch-to-asciidoctor-head.rb
-        bundle exec ruby scripts/switch-to-prawn-head.rb
         rm -f Gemfile.lock
         bundle config --local clean true
         bundle --jobs 3 --retry 3
diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc
index 3c1d27b85..67eb13c75 100644
--- a/CHANGELOG.adoc
+++ b/CHANGELOG.adoc
@@ -11,6 +11,10 @@ Improvements::
 
 * drop links from entries in TOC (#2505)
 
+Compliance::
+
+* lock ttfunk to 1.7.x to avoid requiring Ruby headers (i.e., development libraries) to install gem (#2508)
+
 == 2.3.14 (2024-03-08) - @mojavelinux
 
 Improvements::
diff --git a/asciidoctor-pdf.gemspec b/asciidoctor-pdf.gemspec
index 161eb7229..997e260e3 100644
--- a/asciidoctor-pdf.gemspec
+++ b/asciidoctor-pdf.gemspec
@@ -35,6 +35,7 @@ Gem::Specification.new do |s|
 
   s.add_runtime_dependency 'asciidoctor', '~> 2.0'
   s.add_runtime_dependency 'prawn', '~> 2.4.0'
+  s.add_runtime_dependency 'ttfunk', '~> 1.7.0' # pin ttfunk for compatiblity; prawn gem only pins it to major version
   s.add_runtime_dependency 'matrix', '~> 0.4' # required until prawn >= 2.5.0 is released
   s.add_runtime_dependency 'prawn-table', '~> 0.2.0'
   s.add_runtime_dependency 'prawn-templates', '~> 0.1.0'
diff --git a/lib/asciidoctor/pdf.rb b/lib/asciidoctor/pdf.rb
index c1de9fabd..75a45d216 100644
--- a/lib/asciidoctor/pdf.rb
+++ b/lib/asciidoctor/pdf.rb
@@ -1,5 +1,11 @@
 # frozen_string_literal: true
 
+proc do
+  old_verbose, $VERBOSE = $VERBOSE, nil
+  require 'bigdecimal' # eagerly require bigdecimal without warnings to avoid warning caused by ttfunk 1.7.0
+  $VERBOSE = old_verbose
+end.call
+
 autoload :Set, 'set'
 autoload :StringIO, 'stringio'
 autoload :Tempfile, 'tempfile'
diff --git a/spec/reference/font-otf.pdf b/spec/reference/font-otf.pdf
index 6e0d5c91a..cfb3811d9 100644
Binary files a/spec/reference/font-otf.pdf and b/spec/reference/font-otf.pdf differ