diff --git a/Dockerfile b/Dockerfile
index 516ad1b9..674f8a4c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.15-slim
 
 # Logs go straight to the container log instead of being block-buffered.
 ENV PYTHONUNBUFFERED=1
diff --git a/miss_islington/tasks.py b/miss_islington/tasks.py
index 612e7dbb..42d45ec9 100644
--- a/miss_islington/tasks.py
+++ b/miss_islington/tasks.py
@@ -1,7 +1,6 @@
 import asyncio
 import logging
 import os
-import ssl
 import subprocess
 
 import aiohttp
@@ -20,18 +19,15 @@
 
 app = celery.Celery("backport_cpython")
 
-# REDIS_URL on cabotage, HEROKU_REDIS_MAROON_URL on Heroku. Fail at import if
-# neither is set rather than letting celery fall back to a local amqp broker.
-REDIS_URL = os.environ.get("REDIS_URL") or os.environ["HEROKU_REDIS_MAROON_URL"]
+# Fail at import if REDIS_URL is not set rather than letting celery fall back
+# to a local amqp broker. TLS settings (ssl_cert_reqs, ssl_ca_certs) are
+# carried as query parameters in the rediss:// URL.
+REDIS_URL = os.environ["REDIS_URL"]
 
 app.conf.update(
     broker_url=REDIS_URL,
     result_backend=REDIS_URL,
     broker_connection_retry_on_startup=True,
-    # Used for Heroku's self-signed rediss:// URL. On cabotage the ssl_* query
-    # parameters in REDIS_URL take precedence over these settings.
-    broker_use_ssl={"ssl_cert_reqs": ssl.CERT_NONE},
-    redis_backend_use_ssl={"ssl_cert_reqs": ssl.CERT_NONE},
 )
 
 cache = cachetools.LRUCache(maxsize=500)
diff --git a/runtime.txt b/runtime.txt
deleted file mode 100644
index 76b6e496..00000000
--- a/runtime.txt
+++ /dev/null
@@ -1 +0,0 @@
-python-3.11.6
diff --git a/tests/test_tasks.py b/tests/test_tasks.py
index 2afbd6b7..5ebb2d84 100644
--- a/tests/test_tasks.py
+++ b/tests/test_tasks.py
@@ -4,7 +4,7 @@
 
 from cherry_picker import cherry_picker
 
-os.environ.setdefault("HEROKU_REDIS_MAROON_URL", "someurl")
+os.environ.setdefault("REDIS_URL", "redis://localhost")
 
 from miss_islington import tasks