diff --git a/.rubocop_cc.yml b/.rubocop_cc.yml
index 0fb92b529e0..28891ca7b10 100644
--- a/.rubocop_cc.yml
+++ b/.rubocop_cc.yml
@@ -162,6 +162,8 @@ Lint/AmbiguousRange:
   Enabled: true
 Lint/ConstantOverwrittenInRescue:
   Enabled: true
+Lint/ConstantReassignment:
+  Enabled: true
 Lint/DeprecatedConstants:
   Enabled: true
 Lint/DuplicateBranch:
@@ -172,12 +174,16 @@ Lint/DuplicateMatchPattern:
   Enabled: true
 Lint/DuplicateRegexpCharacterClassElement:
   Enabled: true
+Lint/DuplicateSetElement:
+  Enabled: true
 Lint/EmptyBlock:
   Enabled: true
 Lint/EmptyClass:
   Enabled: true
 Lint/EmptyInPattern:
   Enabled: true
+Lint/HashNewWithKeywordArgumentsAsDefault:
+  Enabled: true
 Lint/IncompatibleIoSelectWithFiberScheduler:
   Enabled: true
 Lint/ItWithoutArgumentsInBlock:
@@ -194,6 +200,8 @@ Lint/NonAtomicFileOperation:
   Enabled: true
 Lint/NumberedParameterAssignment:
   Enabled: true
+Lint/NumericOperationWithConstantResult:
+  Enabled: true
 Lint/OrAssignmentToConstant:
   Enabled: true
 Lint/RedundantDirGlobSort:
@@ -206,16 +214,22 @@ Lint/RequireRangeParentheses:
   Enabled: true
 Lint/RequireRelativeSelfPath:
   Enabled: true
+Lint/SharedMutableDefault:
+  Enabled: true
 Lint/SymbolConversion:
   Enabled: true
 Lint/ToEnumArguments:
   Enabled: true
 Lint/TripleQuotes:
   Enabled: true
+Lint/UnescapedBracketInRegexp:
+  Enabled: true
 Lint/UnexpectedBlockArity:
   Enabled: true
 Lint/UnmodifiedReduceAccumulator:
   Enabled: true
+Lint/UselessDefined:
+  Enabled: true
 Lint/UselessRescue:
   Enabled: true
 Lint/UselessRuby2Keywords:
@@ -228,18 +242,26 @@ Security/CompoundHash:
   Enabled: true
 Security/IoMethods:
   Enabled: true
+Style/AmbiguousEndlessMethodDefinition:
+  Enabled: true
 Style/ArgumentsForwarding:
   Enabled: true
 Style/ArrayIntersect:
   Enabled: true
+Style/BitwisePredicate:
+  Enabled: true
 Style/CollectionCompact:
   Enabled: true
+Style/CombinableDefined:
+  Enabled: true
 Style/ComparableClamp:
   Enabled: true
 Style/ConcatArrayLiterals:
   Enabled: true
 Style/DataInheritance:
   Enabled: true
+Style/DigChain:
+  Enabled: true
 Style/DirEmpty:
   Enabled: true
 Style/DocumentDynamicEvalDefinition:
@@ -256,8 +278,12 @@ Style/FetchEnvVar:
   Enabled: true
 Style/FileEmpty:
   Enabled: true
+Style/FileNull:
+  Enabled: true
 Style/FileRead:
   Enabled: true
+Style/FileTouch:
+  Enabled: true
 Style/FileWrite:
   Enabled: true
 Style/HashConversion:
@@ -268,6 +294,10 @@ Style/IfWithBooleanLiteralBranches:
   Enabled: true
 Style/InPatternThen:
   Enabled: true
+Style/ItAssignment:
+  Enabled: true
+Style/KeywordArgumentsMerging:
+  Enabled: true
 Style/MagicCommentFormat:
   Enabled: true
 Style/MapCompactWithConditionalBlock:
@@ -328,6 +358,8 @@ Style/RedundantStringEscape:
   Enabled: true
 Style/ReturnNilInPredicateMethodDefinition:
   Enabled: true
+Style/SafeNavigationChainLength:
+  Enabled: true
 Style/SelectByRegexp:
   Enabled: true
 Style/StringChars:
@@ -528,6 +560,8 @@ RSpec/SpecFilePathFormat:
   Enabled: true
 RSpec/SpecFilePathSuffix:
   Enabled: true
+RSpec/StringAsInstanceDoubleConstant:
+  Enabled: true
 RSpec/SubjectDeclaration:
   Enabled: true
 RSpec/VerifiedDoubleReference:
diff --git a/config/environment.rb b/config/environment.rb
index 23702b4c21b..2e82d0a1a9c 100644
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -1,4 +1,4 @@
 require File.expand_path('application', __dir__)
 
-Rails.logger = Logger.new('/dev/null')
+Rails.logger = Logger.new(File::NULL)
 Rails.application.initialize!
diff --git a/lib/cloud_controller/blobstore/fingerprints_collection.rb b/lib/cloud_controller/blobstore/fingerprints_collection.rb
index 5ff87270d0b..cf9f562eaa0 100644
--- a/lib/cloud_controller/blobstore/fingerprints_collection.rb
+++ b/lib/cloud_controller/blobstore/fingerprints_collection.rb
@@ -31,7 +31,7 @@ def each(&block)
 
       def parse_mode(raw_mode, filename)
         mode = raw_mode ? raw_mode.to_i(8) : DEFAULT_FILE_MODE
-        unless (mode & 0o600) == 0o600
+        unless mode.allbits?(0o600)
           raise CloudController::Errors::ApiError.new_from_details('AppResourcesFileModeInvalid',
                                                                    "File mode '#{raw_mode}' with path '#{filename}' is invalid. Minimum file mode is '0600'")
         end
diff --git a/spec/request/admin_actions_spec.rb b/spec/request/admin_actions_spec.rb
index df2565a5409..270e45ae617 100644
--- a/spec/request/admin_actions_spec.rb
+++ b/spec/request/admin_actions_spec.rb
@@ -12,7 +12,7 @@
 
     let(:expected_codes_and_responses) do
       h = Hash.new(
-        code: 403
+        { code: 403 }.freeze
       )
       h['admin'] = {
         code: 202
diff --git a/spec/request/app_features_spec.rb b/spec/request/app_features_spec.rb
index 1efcc9eea6d..01abb54e15c 100644
--- a/spec/request/app_features_spec.rb
+++ b/spec/request/app_features_spec.rb
@@ -44,7 +44,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         %w[admin admin_read_only global_auditor space_developer space_manager space_auditor org_manager
            space_supporter].each do |r|
           h[r] = { code: 200, response_object: features_response_object }
@@ -62,7 +62,7 @@
 
   describe 'GET /v3/apps/:guid/features/:name' do
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 404)
+      h = Hash.new({ code: 404 }.freeze)
       %w[admin admin_read_only global_auditor space_developer space_manager space_auditor org_manager
          space_supporter].each do |r|
         h[r] = { code: 200, response_object: feature_response_object }
@@ -132,7 +132,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer].each { |r| h[r] = { code: 200, response_object: feature_response_object } }
         h
@@ -166,7 +166,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer space_supporter].each do |r|
           h[r] = { code: 200, response_object: feature_response_object }
@@ -202,7 +202,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer].each { |r| h[r] = { code: 200, response_object: feature_response_object } }
         h
diff --git a/spec/request/app_manifests_spec.rb b/spec/request/app_manifests_spec.rb
index de384cb3208..b176168f340 100644
--- a/spec/request/app_manifests_spec.rb
+++ b/spec/request/app_manifests_spec.rb
@@ -58,7 +58,7 @@
     context 'permissions' do
       let(:api_call) { ->(user_headers) { get "/v3/apps/#{app_model.guid}/manifest", nil, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['no_role'] = { code: 404 }
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
diff --git a/spec/request/app_usage_events_spec.rb b/spec/request/app_usage_events_spec.rb
index b944d597897..5886c1c90db 100644
--- a/spec/request/app_usage_events_spec.rb
+++ b/spec/request/app_usage_events_spec.rb
@@ -16,8 +16,8 @@
 
     let(:expected_codes_and_responses) do
       h = Hash.new(
-        code: 404,
-        response_object: []
+        { code: 404,
+          response_object: [] }.freeze
       )
       h['admin'] = {
         code: 200,
@@ -63,8 +63,8 @@
 
     let(:expected_codes_and_responses) do
       h = Hash.new(
-        code: 200,
-        response_objects: []
+        { code: 200,
+          response_objects: [] }.freeze
       )
       h['admin'] = {
         code: 200,
@@ -151,7 +151,7 @@
     end
 
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 403)
+      h = Hash.new({ code: 403 }.freeze)
       h['admin'] = { code: 200 }
       h
     end
diff --git a/spec/request/apps_spec.rb b/spec/request/apps_spec.rb
index 55bd493a2eb..2e8f95dbbf6 100644
--- a/spec/request/apps_spec.rb
+++ b/spec/request/apps_spec.rb
@@ -92,7 +92,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['org_billing_manager'] = { code: 422 }
         h['org_auditor'] = { code: 422 }
         h['no_role'] = { code: 422 }
@@ -453,7 +453,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: [app_model1_response_object, app_model2_response_object])
+        h = Hash.new({ code: 200, response_objects: [app_model1_response_object, app_model2_response_object] }.freeze)
 
         h['org_auditor'] = {
           code: 200,
@@ -1359,7 +1359,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: app_model_response_object)
+        h = Hash.new({ code: 200, response_object: app_model_response_object }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -1593,7 +1593,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: app_model_response_object)
+        h = Hash.new({ code: 200, response_object: app_model_response_object }.freeze)
         h['space_supporter'] = { code: 200, response_object: app_model_empty_system_env_response_object }
         h['global_auditor'] = h['org_manager'] = h['space_manager'] = h['space_auditor'] = { code: 403 }
         h['org_auditor'] = h['org_billing_manager'] = h['no_role'] = { code: 404 }
@@ -1725,7 +1725,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = h['admin_read_only'] = h['space_developer'] = { code: 200, response_object: expected_response }
         h['space_supporter'] = { code: 200, response_object: expected_response_system_env_redacted }
         h['org_auditor'] = h['org_billing_manager'] = h['no_role'] = { code: 404 }
@@ -1741,7 +1741,7 @@
 
         it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS do
           let(:expected_codes_and_responses) do
-            h = Hash.new(code: 403)
+            h = Hash.new({ code: 403 }.freeze)
             h['admin'] = h['admin_read_only'] = { code: 200, response_object: expected_response }
             h['org_auditor'] = h['org_billing_manager'] = h['no_role'] = { code: 404 }
             h
@@ -1810,7 +1810,7 @@
         ->(headers) { get "/v3/apps/#{app_model.guid}/builds", nil, headers }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_guids: [build.guid, second_build.guid])
+        h = Hash.new({ code: 200, response_guids: [build.guid, second_build.guid] }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -1952,7 +1952,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200)
+        h = Hash.new({ code: 200 }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -2005,7 +2005,7 @@
     context 'permissions for deleting an app' do
       let(:api_call) { ->(user_headers) { delete "/v3/apps/#{app_model.guid}", nil, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 202)
+        h = Hash.new({ code: 202 }.freeze)
         %w[admin_read_only global_auditor org_manager space_auditor space_manager space_supporter].each do |r|
           h[r] = { code: 403, errors: CF_NOT_AUTHORIZED }
         end
@@ -2229,7 +2229,7 @@
     context 'permissions for updating an app' do
       let(:api_call) { ->(user_headers) { patch "/v3/apps/#{app_model.guid}", update_request.to_json, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response_object)
+        h = Hash.new({ code: 200, response_object: expected_response_object }.freeze)
         %w[admin_read_only global_auditor org_manager space_auditor space_manager space_supporter].each do |r|
           h[r] = { code: 403, errors: CF_NOT_AUTHORIZED }
         end
@@ -2359,7 +2359,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['no_role'] = { code: 404 }
           h['org_auditor'] = { code: 404 }
           h['org_billing_manager'] = { code: 404 }
@@ -2699,7 +2699,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['no_role'] = { code: 404 }
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
@@ -2868,7 +2868,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['no_role'] = { code: 404 }
           h['org_auditor'] = { code: 404 }
           h['org_billing_manager'] = { code: 404 }
@@ -2953,7 +2953,7 @@
     end
 
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 200, response_object: expected_response)
+      h = Hash.new({ code: 200, response_object: expected_response }.freeze)
       h['no_role'] = { code: 404 }
       h['org_billing_manager'] = { code: 404 }
       h['org_auditor'] = { code: 404 }
@@ -3016,7 +3016,7 @@
       }
     end
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 200, response_object: expected_response)
+      h = Hash.new({ code: 200, response_object: expected_response }.freeze)
       h['no_role'] = { code: 404 }
       h['org_billing_manager'] = { code: 404 }
       h['org_auditor'] = { code: 404 }
@@ -3074,7 +3074,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['no_role'] = { code: 404 }
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
@@ -3294,7 +3294,7 @@
       }
     end
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 404)
+      h = Hash.new({ code: 404 }.freeze)
       %w[global_auditor admin_read_only org_manager space_auditor space_manager].each do |r|
         h[r] = { code: 403, errors: CF_NOT_AUTHORIZED }
       end
@@ -3343,7 +3343,7 @@
 
     it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['global_auditor'] = h['org_manager'] = h['space_auditor'] = h['space_manager'] = { code: 403 }
         h['admin'] = h['admin_read_only'] = h['space_developer'] = h['space_supporter'] = {
           code: 200,
@@ -3360,7 +3360,7 @@
 
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['global_auditor'] = h['org_manager'] = h['space_auditor'] = h['space_manager'] = h['space_developer'] = h['space_supporter'] = { code: 403 }
           h['admin'] = h['admin_read_only'] = {
             code: 200,
@@ -3393,7 +3393,7 @@
     end
 
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 404)
+      h = Hash.new({ code: 404 }.freeze)
       h['admin'] = { code: 200, response_object: read_all_response }
       h['admin_read_only'] = { code: 200, response_object: read_all_response }
       h['global_auditor'] = { code: 200, response_object: read_basic_response }
diff --git a/spec/request/buildpacks_spec.rb b/spec/request/buildpacks_spec.rb
index 7c3e9a0dd00..78a0d859bd7 100644
--- a/spec/request/buildpacks_spec.rb
+++ b/spec/request/buildpacks_spec.rb
@@ -282,7 +282,7 @@
       let(:org) { VCAP::CloudController::Organization.make }
       let(:space) { VCAP::CloudController::Space.make(organization: org) }
       let(:api_call) { ->(user_headers) { get '/v3/buildpacks', nil, user_headers } }
-      let(:expected_codes_and_responses) { Hash.new(code: 200) }
+      let(:expected_codes_and_responses) { Hash.new({ code: 200 }.freeze) }
 
       before do
         space.organization.add_user(user)
@@ -460,7 +460,7 @@
       context 'the buildpack does not exist' do
         let(:api_call) { ->(user_headers) { get '/v3/buildpacks/does-not-exist', nil, user_headers } }
 
-        let(:expected_codes_and_responses) { Hash.new(code: 404) }
+        let(:expected_codes_and_responses) { Hash.new({ code: 404 }.freeze) }
 
         it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS
       end
@@ -492,7 +492,7 @@
           }
         end
 
-        let(:expected_codes_and_responses) { Hash.new(code: 200, response_object: buildpack_response) }
+        let(:expected_codes_and_responses) { Hash.new({ code: 200, response_object: buildpack_response }.freeze) }
 
         it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS
       end
diff --git a/spec/request/builds_spec.rb b/spec/request/builds_spec.rb
index c701697f43e..0a72800ec9c 100644
--- a/spec/request/builds_spec.rb
+++ b/spec/request/builds_spec.rb
@@ -127,7 +127,7 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 422
+          { code: 422 }.freeze
         )
         h['admin'] = {
           code: 201
@@ -292,8 +292,8 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_guids: [build.guid, second_build.guid]
+            { code: 200,
+              response_guids: [build.guid, second_build.guid] }.freeze
           )
           h['org_auditor'] = { code: 200, response_objects: [] }
           h['org_billing_manager'] = { code: 200, response_objects: [] }
@@ -511,7 +511,7 @@
         let(:api_call) { ->(user_headers) { get "v3/builds/#{build.guid}", nil, user_headers } }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200)
+          h = Hash.new({ code: 200 }.freeze)
           h['org_auditor'] = { code: 404 }
           h['org_billing_manager'] = { code: 404 }
           h['no_role'] = { code: 404 }
@@ -582,7 +582,7 @@
         let(:api_call) { ->(user_headers) { patch "/v3/builds/#{build_model.guid}", { metadata: }.to_json, user_headers } }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = { code: 200 }
           h['org_auditor'] = { code: 404 }
           h['org_billing_manager'] = { code: 404 }
diff --git a/spec/request/deployments_spec.rb b/spec/request/deployments_spec.rb
index b212545b05c..c059d037789 100644
--- a/spec/request/deployments_spec.rb
+++ b/spec/request/deployments_spec.rb
@@ -87,7 +87,7 @@
       end
       let(:api_call) { ->(user_headers) { post '/v3/deployments', create_request.to_json, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 422)
+        h = Hash.new({ code: 422 }.freeze)
         h['admin'] = h['space_developer'] = h['space_supporter'] = { code: 201, response_object: expected_response }
         h
       end
@@ -1141,7 +1141,7 @@
       let(:api_call) { ->(user_headers) { patch "/v3/deployments/#{deployment.guid}", update_request, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200 }
         h['space_developer'] = { code: 200 }
         %w[org_auditor org_billing_manager no_role].each { |r| h[r] = { code: 404 } }
@@ -1227,7 +1227,7 @@
       }
     end
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 200, response_object: expected_response)
+      h = Hash.new({ code: 200, response_object: expected_response }.freeze)
       h['org_auditor'] = h['org_billing_manager'] = h['no_role'] = { code: 404 }
       h
     end
@@ -1442,21 +1442,21 @@ def json_for_deployment(deployment, app_model, droplet, status_value, status_rea
           let(:endpoint) { "#{url}?#{query}" }
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                json_for_deployment(deployment3, app3, droplet3,
-                                    VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
-                                    VCAP::CloudController::DeploymentModel::DEPLOYED_STATUS_REASON,
-                                    false),
-                json_for_deployment(deployment4, app4, droplet4,
-                                    VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
-                                    VCAP::CloudController::DeploymentModel::CANCELED_STATUS_REASON,
-                                    false),
-                json_for_deployment(deployment5, app5, droplet5,
-                                    VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
-                                    VCAP::CloudController::DeploymentModel::SUPERSEDED_STATUS_REASON,
-                                    false)
-              ]
+              { code: 200,
+                response_objects: [
+                  json_for_deployment(deployment3, app3, droplet3,
+                                      VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
+                                      VCAP::CloudController::DeploymentModel::DEPLOYED_STATUS_REASON,
+                                      false),
+                  json_for_deployment(deployment4, app4, droplet4,
+                                      VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
+                                      VCAP::CloudController::DeploymentModel::CANCELED_STATUS_REASON,
+                                      false),
+                  json_for_deployment(deployment5, app5, droplet5,
+                                      VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
+                                      VCAP::CloudController::DeploymentModel::SUPERSEDED_STATUS_REASON,
+                                      false)
+                ] }.freeze
             )
             h['org_billing_manager'] = h['org_auditor'] = h['no_role'] = {
               code: 200,
@@ -1492,17 +1492,17 @@ def json_for_deployment(deployment, app_model, droplet, status_value, status_rea
           let(:endpoint) { "#{url}?#{query}" }
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                json_for_deployment(deployment3, app3, droplet3,
-                                    VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
-                                    VCAP::CloudController::DeploymentModel::DEPLOYED_STATUS_REASON,
-                                    false),
-                json_for_deployment(deployment5, app5, droplet5,
-                                    VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
-                                    VCAP::CloudController::DeploymentModel::SUPERSEDED_STATUS_REASON,
-                                    false)
-              ]
+              { code: 200,
+                response_objects: [
+                  json_for_deployment(deployment3, app3, droplet3,
+                                      VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
+                                      VCAP::CloudController::DeploymentModel::DEPLOYED_STATUS_REASON,
+                                      false),
+                  json_for_deployment(deployment5, app5, droplet5,
+                                      VCAP::CloudController::DeploymentModel::FINALIZED_STATUS_VALUE,
+                                      VCAP::CloudController::DeploymentModel::SUPERSEDED_STATUS_REASON,
+                                      false)
+                ] }.freeze
             )
             h['org_billing_manager'] = h['org_auditor'] = h['no_role'] = {
               code: 200,
@@ -1538,15 +1538,15 @@ def json_for_deployment(deployment, app_model, droplet, status_value, status_rea
           let(:endpoint) { "#{url}?#{query}" }
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                json_for_deployment(deployment, app_model, droplet,
-                                    VCAP::CloudController::DeploymentModel::ACTIVE_STATUS_VALUE,
-                                    VCAP::CloudController::DeploymentModel::DEPLOYING_STATUS_REASON),
-                json_for_deployment(deployment6, app5, droplet5,
-                                    VCAP::CloudController::DeploymentModel::ACTIVE_STATUS_VALUE,
-                                    VCAP::CloudController::DeploymentModel::DEPLOYING_STATUS_REASON)
-              ]
+              { code: 200,
+                response_objects: [
+                  json_for_deployment(deployment, app_model, droplet,
+                                      VCAP::CloudController::DeploymentModel::ACTIVE_STATUS_VALUE,
+                                      VCAP::CloudController::DeploymentModel::DEPLOYING_STATUS_REASON),
+                  json_for_deployment(deployment6, app5, droplet5,
+                                      VCAP::CloudController::DeploymentModel::ACTIVE_STATUS_VALUE,
+                                      VCAP::CloudController::DeploymentModel::DEPLOYING_STATUS_REASON)
+                ] }.freeze
             )
             h['org_billing_manager'] = h['org_auditor'] = h['no_role'] = {
               code: 200,
@@ -1721,7 +1721,7 @@ def json_for_deployment(deployment, app_model, droplet, status_value, status_rea
     context 'with a running deployment' do
       let(:api_call) { ->(user_headers) { post "/v3/deployments/#{deployment.guid}/actions/cancel", {}.to_json, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = h['space_developer'] = h['space_supporter'] = { code: 200 }
         h
       end
@@ -1845,7 +1845,7 @@ def json_for_deployment(deployment, app_model, droplet, status_value, status_rea
       let(:state) { VCAP::CloudController::DeploymentModel::PAUSED_STATE }
       let(:api_call) { ->(user_headers) { post "/v3/deployments/#{deployment.guid}/actions/continue", {}.to_json, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = h['space_developer'] = h['space_supporter'] = { code: 200 }
         h
       end
diff --git a/spec/request/domains_spec.rb b/spec/request/domains_spec.rb
index 749ad06a63c..9e9ec074d48 100644
--- a/spec/request/domains_spec.rb
+++ b/spec/request/domains_spec.rb
@@ -207,13 +207,13 @@
           let(:api_call) { ->(user_headers) { get '/v3/domains', nil, user_headers } }
           let(:expected_codes_and_responses) do
             Hash.new(
-              code: 200,
-              response_objects: [
-                visible_owned_private_domain_json,
-                visible_shared_private_domain_json,
-                not_visible_private_domain_json,
-                shared_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  visible_owned_private_domain_json,
+                  visible_shared_private_domain_json,
+                  not_visible_private_domain_json,
+                  shared_domain_json
+                ] }.freeze
             )
           end
 
@@ -233,12 +233,12 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                visible_owned_private_domain_json,
-                visible_shared_private_domain_json,
-                shared_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  visible_owned_private_domain_json,
+                  visible_shared_private_domain_json,
+                  shared_domain_json
+                ] }.freeze
             )
             h['org_billing_manager'] = {
               code: 200,
@@ -269,12 +269,12 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                visible_owned_private_domain_json,
-                visible_shared_private_domain_json,
-                shared_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  visible_owned_private_domain_json,
+                  visible_shared_private_domain_json,
+                  shared_domain_json
+                ] }.freeze
             )
             # because the user is a manager in the shared org, they have access to see the domain
             h['org_billing_manager'] = {
@@ -305,10 +305,10 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: [
-              visible_shared_private_domain_json
-            ]
+            { code: 200,
+              response_objects: [
+                visible_shared_private_domain_json
+              ] }.freeze
           )
           # because the user is a manager in the shared org, they have access to see the domain
           h['org_billing_manager'] = {
@@ -350,10 +350,10 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: [
-              visible_shared_private_domain_json
-            ]
+            { code: 200,
+              response_objects: [
+                visible_shared_private_domain_json
+              ] }.freeze
           )
           # because the user is a manager in the shared org, they have access to see the domain
           h['org_billing_manager'] = {
@@ -395,11 +395,11 @@
         context 'when the user can read globally' do
           let(:expected_codes_and_responses) do
             Hash.new(
-              code: 200,
-              response_objects: [
-                visible_shared_private_domain_json,
-                not_visible_private_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  visible_shared_private_domain_json,
+                  not_visible_private_domain_json
+                ] }.freeze
             )
           end
 
@@ -409,10 +409,10 @@
         context 'when the user cannot read globally' do
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                visible_shared_private_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  visible_shared_private_domain_json
+                ] }.freeze
             )
             # because the user is a manager in the shared org, they have access to see the domain
             h['org_billing_manager'] = {
@@ -639,8 +639,8 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_object: matching_route_json
+          { code: 200,
+            response_object: matching_route_json }.freeze
         )
         h['org_billing_manager'] = {
           code: 404
@@ -667,8 +667,8 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_object: matching_route_json
+            { code: 200,
+              response_object: matching_route_json }.freeze
           )
           h['org_billing_manager'] = {
             code: 404
@@ -694,8 +694,8 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_object: matching_route_json
+            { code: 200,
+              response_object: matching_route_json }.freeze
           )
           h['org_billing_manager'] = {
             code: 404
@@ -735,8 +735,8 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_object: matching_route_json
+            { code: 200,
+              response_object: matching_route_json }.freeze
           )
           h
         end
@@ -839,7 +839,7 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 403
+          { code: 403 }.freeze
         )
         h['admin'] = {
           code: 201,
@@ -968,7 +968,7 @@
         let(:api_call) { ->(user_headers) { post '/v3/domains', private_domain_params.to_json, user_headers } }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = {
             code: 201,
             response_object: domain_json
@@ -1520,7 +1520,7 @@
         let(:api_call) { ->(user_headers) { post "/v3/domains/#{private_domain.guid}/relationships/shared_organizations", private_domain_params.to_json, user_headers } }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = {
             code: 200,
             response_object: domain_shared_orgs
@@ -1576,7 +1576,7 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 404
+          { code: 404 }.freeze
         )
         h['admin'] = {
           code: 200,
@@ -1611,7 +1611,7 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 403
+          { code: 403 }.freeze
         )
 
         h['admin'] = {
@@ -1648,7 +1648,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 202 }
         h['org_manager'] = { code: 202 }
         h['org_billing_manager'] = { code: 404 }
@@ -1826,7 +1826,7 @@
       let(:api_call) { ->(user_headers) { delete "/v3/domains/#{private_domain.guid}/relationships/shared_organizations/#{shared_org1.guid}", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[org_billing_manager no_role].each { |r| h[r] = { code: 404 } }
         h['org_manager'] = { code: 403, errors: CF_ORG_SUSPENDED }
         h['admin'] = { code: 204 }
@@ -1847,7 +1847,7 @@
       let(:api_call) { ->(user_headers) { delete "/v3/domains/#{private_domain.guid}/relationships/shared_organizations/#{shared_org1.guid}", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[org_billing_manager no_role].each { |r| h[r] = { code: 404 } }
         h['org_manager'] = { code: 403, errors: CF_ORG_SUSPENDED }
         h['admin'] = { code: 204 }
@@ -1882,7 +1882,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 204
+            { code: 204 }.freeze
           )
 
           h['admin_read_only'] = {
@@ -1905,7 +1905,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = {
             code: 204
           }
@@ -1972,8 +1972,8 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_object: shared_domain_json
+          { code: 200,
+            response_object: shared_domain_json }.freeze
         )
         h
       end
@@ -2019,8 +2019,8 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_object: private_domain_json
+            { code: 200,
+              response_object: private_domain_json }.freeze
           )
           h['org_billing_manager'] = {
             code: 404
@@ -2090,8 +2090,8 @@
 
           let(:expected_codes_and_responses) do
             Hash.new(
-              code: 200,
-              response_object: private_domain_json
+              { code: 200,
+                response_object: private_domain_json }.freeze
             )
           end
 
@@ -2103,8 +2103,8 @@
 
           let(:expected_codes_and_responses) do
             Hash.new(
-              code: 200,
-              response_object: private_domain_json
+              { code: 200,
+                response_object: private_domain_json }.freeze
             )
           end
 
@@ -2185,7 +2185,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
 
         h['admin'] = { code: 200, response_object: domain_json }
 
@@ -2240,7 +2240,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
 
         h['admin'] = { code: 200, response_object: domain_json }
         h['org_manager'] = { code: 200, response_object: domain_json }
@@ -2312,7 +2312,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
 
         h['admin'] = { code: 200, response_object: domain_json }
         h['org_billing_manager'] = { code: 404 }
diff --git a/spec/request/droplets_spec.rb b/spec/request/droplets_spec.rb
index 77643b1f48c..03940217808 100644
--- a/spec/request/droplets_spec.rb
+++ b/spec/request/droplets_spec.rb
@@ -70,7 +70,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['org_auditor'] = {
           code: 422
         }
@@ -260,7 +260,7 @@
       end
       let(:api_call) { ->(user_headers) { get "/v3/droplets/#{guid}", nil, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: droplet_model_json)
+        h = Hash.new({ code: 200, response_object: droplet_model_json }.freeze)
         h['global_auditor'] = { code: 200, response_object: redacted_droplet_model_json }
         h['org_manager'] = { code: 200, response_object: redacted_droplet_model_json }
         h['space_manager'] = { code: 200, response_object: redacted_droplet_model_json }
@@ -330,7 +330,7 @@
       end
       let(:api_call) { ->(user_headers) { get "/v3/droplets/#{guid}", nil, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: droplet_model_json)
+        h = Hash.new({ code: 200, response_object: droplet_model_json }.freeze)
         h['global_auditor'] = { code: 200, response_object: redacted_droplet_model_json }
         h['org_manager'] = { code: 200, response_object: redacted_droplet_model_json }
         h['space_manager'] = { code: 200, response_object: redacted_droplet_model_json }
@@ -377,7 +377,7 @@
       let(:api_call) { ->(user_headers) { get "/v3/droplets/#{guid}/download", nil, user_headers } }
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 302
+          { code: 302 }.freeze
         )
         h['space_supporter'] = {
           code: 403
@@ -718,8 +718,8 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_objects: [droplet1_json, droplet2_json]
+          { code: 200,
+            response_objects: [droplet1_json, droplet2_json] }.freeze
         )
 
         h['admin'] = { code: 200, response_objects: [droplet1_json, droplet2_json, droplet_in_other_space_json] }
@@ -1036,7 +1036,7 @@
       end
     end
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+      h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
       h['admin'] = { code: 202 }
       h['org_auditor'] = { code: 404 }
       h['org_billing_manager'] = { code: 404 }
@@ -1320,7 +1320,7 @@
         }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: app_droplet_json)
+        h = Hash.new({ code: 200, response_object: app_droplet_json }.freeze)
         h['org_billing_manager'] = { code: 404 }
         h['org_auditor'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -1516,7 +1516,7 @@
         }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: package_droplet_json)
+        h = Hash.new({ code: 200, response_object: package_droplet_json }.freeze)
         h['org_billing_manager'] = { code: 404 }
         h['org_auditor'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -1586,7 +1586,7 @@
       }
     end
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+      h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
       h['admin'] = { code: 201, response_object: expected_copied_response }
       h['org_auditor'] = { code: 404 }
       h['org_billing_manager'] = { code: 404 }
@@ -1660,7 +1660,7 @@
     end
 
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+      h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
       h['admin'] = {
         code: 202,
         response_object: droplet_json
@@ -1864,7 +1864,7 @@
         }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200, response_object: droplet_json }
         h['space_developer'] = { code: 200, response_object: droplet_json }
         h['org_auditor'] = { code: 404 }
diff --git a/spec/request/environment_variable_groups_spec.rb b/spec/request/environment_variable_groups_spec.rb
index 4031a3b31ab..6ba256a1899 100644
--- a/spec/request/environment_variable_groups_spec.rb
+++ b/spec/request/environment_variable_groups_spec.rb
@@ -77,7 +77,7 @@
       let(:org) { VCAP::CloudController::Organization.make }
       let(:space) { VCAP::CloudController::Space.make(organization: org) }
       let(:api_call) { ->(user_headers) { get '/v3/environment_variable_groups/running', nil, user_headers } }
-      let(:expected_codes_and_responses) { Hash.new(code: 200) }
+      let(:expected_codes_and_responses) { Hash.new({ code: 200 }.freeze) }
 
       before do
         space.organization.add_user(user)
@@ -193,7 +193,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = { code: 200, response_object: env_group_json }
         h
       end
diff --git a/spec/request/events_spec.rb b/spec/request/events_spec.rb
index fbe1bc2198b..4c6cff514f2 100644
--- a/spec/request/events_spec.rb
+++ b/spec/request/events_spec.rb
@@ -107,7 +107,7 @@
       let(:api_call) { ->(user_headers) { get '/v3/audit_events', nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: [])
+        h = Hash.new({ code: 200, response_objects: [] }.freeze)
 
         h['admin'] = { code: 200, response_objects: [unscoped_event_json, org_scoped_event_json, space_scoped_event_json] }
         h['admin_read_only'] = { code: 200, response_objects: [unscoped_event_json, org_scoped_event_json, space_scoped_event_json] }
@@ -285,8 +285,8 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_object: event_json
+              { code: 200,
+                response_object: event_json }.freeze
             )
             h
           end
@@ -345,8 +345,8 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_object: event_json
+            { code: 200,
+              response_object: event_json }.freeze
           )
           h['space_auditor'] = {
             code: 404,
@@ -388,8 +388,8 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_object: event_json
+              { code: 200,
+                response_object: event_json }.freeze
             )
             h
           end
@@ -445,8 +445,8 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 404,
-            response_object: []
+            { code: 404,
+              response_object: [] }.freeze
           )
           %w[admin admin_read_only global_auditor].each do |role|
             h[role] = {
diff --git a/spec/request/info_spec.rb b/spec/request/info_spec.rb
index 68b46885768..d5003a250fe 100644
--- a/spec/request/info_spec.rb
+++ b/spec/request/info_spec.rb
@@ -96,7 +96,7 @@
     end
 
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 404)
+      h = Hash.new({ code: 404 }.freeze)
       h['admin'] = { code: 200, response_object: info_summary }
       h['admin_read_only'] = { code: 200, response_object: info_summary }
       h['global_auditor'] = { code: 200, response_object: info_summary }
diff --git a/spec/request/internal/log_access_spec.rb b/spec/request/internal/log_access_spec.rb
index a7bfe4b34c1..ed6f85339e2 100644
--- a/spec/request/internal/log_access_spec.rb
+++ b/spec/request/internal/log_access_spec.rb
@@ -11,7 +11,7 @@
     context 'permissions' do
       let(:api_call) { ->(user_headers) { get "/internal/v4/log_access/#{app_model.guid}", nil, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200)
+        h = Hash.new({ code: 200 }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         h
       end
diff --git a/spec/request/isolation_segments_spec.rb b/spec/request/isolation_segments_spec.rb
index dfb539d08b1..c362272f507 100644
--- a/spec/request/isolation_segments_spec.rb
+++ b/spec/request/isolation_segments_spec.rb
@@ -88,7 +88,7 @@
         let(:user) { VCAP::CloudController::User.make }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_guids: [org1.guid, org2.guid, space.organization.guid])
+          h = Hash.new({ code: 200, response_guids: [org1.guid, org2.guid, space.organization.guid] }.freeze)
           h['org_auditor'] = { code: 200, response_guids: [space.organization.guid] }
           h['org_billing_manager'] = { code: 200, response_guids: [space.organization.guid] }
           h['org_manager'] = { code: 200, response_guids: [space.organization.guid] }
@@ -136,7 +136,7 @@
         let(:user) { VCAP::CloudController::User.make }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_guids: [space1.guid, space2.guid])
+          h = Hash.new({ code: 200, response_guids: [space1.guid, space2.guid] }.freeze)
           h['org_auditor'] = { code: 200, response_guids: [] }
           h['org_billing_manager'] = { code: 200, response_guids: [] }
           h['org_manager'] = { code: 200, response_guids: [space1.guid] }
@@ -230,7 +230,7 @@
         let(:org) { space.organization }
         let(:user) { VCAP::CloudController::User.make }
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_object: expected_response_object)
+          h = Hash.new({ code: 200, response_object: expected_response_object }.freeze)
           h['no_role'] = { code: 404 }
           h
         end
@@ -243,7 +243,7 @@
         let(:org) { space.organization }
         let(:user) { VCAP::CloudController::User.make }
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = { code: 200, response_object: expected_response_object }
           h['admin_read_only'] = { code: 200, response_object: expected_response_object }
           h['global_auditor'] = { code: 200, response_object: expected_response_object }
@@ -485,7 +485,7 @@
         let(:org) { space.organization }
         let(:user) { VCAP::CloudController::User.make }
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_guids: [iso_seg1.guid])
+          h = Hash.new({ code: 200, response_guids: [iso_seg1.guid] }.freeze)
           h['admin'] = { code: 200, response_guids: [iso_seg1.guid, VCAP::CloudController::IsolationSegmentModel::SHARED_ISOLATION_SEGMENT_GUID] }
           h['admin_read_only'] = { code: 200, response_guids: [iso_seg1.guid, VCAP::CloudController::IsolationSegmentModel::SHARED_ISOLATION_SEGMENT_GUID] }
           h['global_auditor'] = { code: 200, response_guids: [iso_seg1.guid, VCAP::CloudController::IsolationSegmentModel::SHARED_ISOLATION_SEGMENT_GUID] }
diff --git a/spec/request/jobs_spec.rb b/spec/request/jobs_spec.rb
index 7ff85cd852a..13c94028ddd 100644
--- a/spec/request/jobs_spec.rb
+++ b/spec/request/jobs_spec.rb
@@ -167,7 +167,7 @@ def display_name
 
     context 'when the user has a global scope or a local role' do
       let(:api_call) { ->(user_headers) { get "/v3/jobs/#{job.guid}", nil, user_headers } }
-      let(:expected_codes_and_responses) { Hash.new(code: 200) }
+      let(:expected_codes_and_responses) { Hash.new({ code: 200 }.freeze) }
 
       before do
         space.organization.add_user(user)
diff --git a/spec/request/organization_quotas_spec.rb b/spec/request/organization_quotas_spec.rb
index 8bda69aff05..fd55ce8a1cc 100644
--- a/spec/request/organization_quotas_spec.rb
+++ b/spec/request/organization_quotas_spec.rb
@@ -63,7 +63,7 @@ module VCAP::CloudController
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 403
+          { code: 403 }.freeze
         )
         h['admin'] = {
           code: 201,
@@ -203,7 +203,7 @@ module VCAP::CloudController
         let(:org_response) { { guid: 'organization-guid' } }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_objects: generate_org_quota_list_response([org_response], false))
+          h = Hash.new({ code: 200, response_objects: generate_org_quota_list_response([org_response], false) }.freeze)
           h['admin'] = { code: 200, response_objects: generate_org_quota_list_response([org_response, other_org_response], true) }
           h['admin_read_only'] = { code: 200, response_objects: generate_org_quota_list_response([org_response, other_org_response], true) }
           h['global_auditor'] = { code: 200, response_objects: generate_org_quota_list_response([org_response, other_org_response], true) }
@@ -270,7 +270,7 @@ module VCAP::CloudController
         let(:org_response) { { guid: 'organization-guid' } }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_object: generate_org_quota_single_response([org_response]))
+          h = Hash.new({ code: 200, response_object: generate_org_quota_single_response([org_response]) }.freeze)
           h['admin'] = { code: 200, response_object: generate_org_quota_single_response([org_response, other_org_response]) }
           h['admin_read_only'] = { code: 200, response_object: generate_org_quota_single_response([org_response, other_org_response]) }
           h['global_auditor'] = { code: 200, response_object: generate_org_quota_single_response([org_response, other_org_response]) }
@@ -376,7 +376,7 @@ module VCAP::CloudController
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 403
+          { code: 403 }.freeze
         )
         h['admin'] = {
           code: 200,
@@ -504,7 +504,7 @@ module VCAP::CloudController
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = { code: 200, response_object: data_json }
           h
         end
@@ -572,7 +572,7 @@ module VCAP::CloudController
 
       context 'when deleting an organization quota' do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = { code: 202 }
           h
         end
diff --git a/spec/request/organizations_spec.rb b/spec/request/organizations_spec.rb
index 00f5ca1ada3..3752c476d07 100644
--- a/spec/request/organizations_spec.rb
+++ b/spec/request/organizations_spec.rb
@@ -319,7 +319,7 @@ module VCAP::CloudController
           let(:space) { VCAP::CloudController::Space.make }
           let(:org) { space.organization }
           let(:expected_codes_and_responses) do
-            h = Hash.new(code: 200, response_guids: [org.guid])
+            h = Hash.new({ code: 200, response_guids: [org.guid] }.freeze)
             h['admin'] = { code: 200, response_guids: VCAP::CloudController::Organization.select_map(:guid) }
             h['admin_read_only'] = { code: 200, response_guids: VCAP::CloudController::Organization.select_map(:guid) }
             h['global_auditor'] = { code: 200, response_guids: VCAP::CloudController::Organization.select_map(:guid) }
@@ -552,12 +552,12 @@ module VCAP::CloudController
           let(:api_call) { ->(user_headers) { get "/v3/organizations/#{org.guid}/domains", nil, user_headers } }
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                shared_domain_json,
-                owned_private_domain_json,
-                shared_private_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  shared_domain_json,
+                  owned_private_domain_json,
+                  shared_private_domain_json
+                ] }.freeze
             )
             h['org_billing_manager'] = {
               code: 200,
@@ -580,10 +580,10 @@ module VCAP::CloudController
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                shared_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  shared_domain_json
+                ] }.freeze
             )
             h['no_role'] = {
               code: 404
@@ -599,10 +599,10 @@ module VCAP::CloudController
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                shared_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  shared_domain_json
+                ] }.freeze
             )
             h['no_role'] = {
               code: 404
@@ -618,10 +618,10 @@ module VCAP::CloudController
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_objects: [
-                owned_private_domain_json
-              ]
+              { code: 200,
+                response_objects: [
+                  owned_private_domain_json
+                ] }.freeze
             )
             h['org_billing_manager'] = {
               code: 200,
@@ -842,8 +842,8 @@ module VCAP::CloudController
         let!(:tcp_domain) { SharedDomain.make(router_group_guid: 'default-tcp') }
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_object: domain_json
+            { code: 200,
+              response_object: domain_json }.freeze
           )
           h['no_role'] = { code: 404 }
           h
@@ -860,8 +860,8 @@ module VCAP::CloudController
         context 'when at least one private domain exists' do
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 200,
-              response_object: domain_json
+              { code: 200,
+                response_object: domain_json }.freeze
             )
             h['org_billing_manager'] = { code: 404 }
             h['no_role'] = { code: 404 }
@@ -943,7 +943,7 @@ module VCAP::CloudController
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 404
+            { code: 404 }.freeze
           )
           h
         end
@@ -956,7 +956,7 @@ module VCAP::CloudController
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 404
+            { code: 404 }.freeze
           )
           h
         end
@@ -967,7 +967,7 @@ module VCAP::CloudController
       context 'when no domains exist' do
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 404
+            { code: 404 }.freeze
           )
           h
         end
@@ -1011,8 +1011,8 @@ module VCAP::CloudController
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_object: org_summary_json
+          { code: 200,
+            response_object: org_summary_json }.freeze
         )
         h['no_role'] = { code: 404 }
         h
@@ -1088,7 +1088,7 @@ module VCAP::CloudController
         let(:space) { Space.make(organization: org) }
         let(:api_call) { ->(user_headers) { patch "/v3/organizations/#{org.guid}/relationships/default_isolation_segment", nil, user_headers } }
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = { code: 200 }
           h['org_manager'] = { code: 403, errors: CF_ORG_SUSPENDED }
           h['no_role'] = { code: 404 }
@@ -1128,7 +1128,7 @@ module VCAP::CloudController
         }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response_object)
+        h = Hash.new({ code: 200, response_object: expected_response_object }.freeze)
         h['no_role'] = { code: 404 }
         h
       end
@@ -1294,7 +1294,7 @@ module VCAP::CloudController
         let(:space) { Space.make(organization: org) }
         let(:api_call) { ->(user_headers) { patch "/v3/organizations/#{org.guid}", nil, user_headers } }
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = { code: 200 }
           h['org_manager'] = { code: 403, errors: CF_ORG_SUSPENDED }
           h['no_role'] = { code: 404 }
@@ -1376,7 +1376,7 @@ module VCAP::CloudController
 
       context 'when the user is a member in the org' do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = { code: 202 }
           h['no_role'] = { code: 404 }
           h
@@ -1649,11 +1649,11 @@ module VCAP::CloudController
         let(:org_manager_json) { build_user_json(org_manager.guid, 'rob-mcjames', 'Okta') }
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: [
-              user_json,
-              org_manager_json
-            ]
+            { code: 200,
+              response_objects: [
+                user_json,
+                org_manager_json
+              ] }.freeze
           )
           h['no_role'] = {
             code: 404
diff --git a/spec/request/packages_spec.rb b/spec/request/packages_spec.rb
index 012debc6e58..3d8c0c90d02 100644
--- a/spec/request/packages_spec.rb
+++ b/spec/request/packages_spec.rb
@@ -103,7 +103,7 @@
         let(:org) { space.organization }
         let(:user) { VCAP::CloudController::User.make }
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 201)
+          h = Hash.new({ code: 201 }.freeze)
           h['org_auditor'] = { code: 422 }
           h['org_billing_manager'] = { code: 422 }
           h['no_role'] = { code: 422 }
@@ -213,7 +213,7 @@
           }
         end
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 201)
+          h = Hash.new({ code: 201 }.freeze)
           h['org_auditor'] = { code: 422 }
           h['org_billing_manager'] = { code: 422 }
           h['no_role'] = { code: 422 }
@@ -296,7 +296,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: packages_response_objects)
+        h = Hash.new({ code: 200, response_objects: packages_response_objects }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -548,7 +548,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: packages_response_objects)
+        h = Hash.new({ code: 200, response_objects: packages_response_objects }.freeze)
         h['org_auditor'] = { code: 200, response_objects: [] }
         h['org_billing_manager'] = { code: 200, response_objects: [] }
         h['no_role'] = { code: 200, response_objects: [] }
@@ -810,7 +810,7 @@
       }
     end
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 200, response_object: package_model_response_object)
+      h = Hash.new({ code: 200, response_object: package_model_response_object }.freeze)
       h['org_auditor'] = { code: 404 }
       h['org_billing_manager'] = { code: 404 }
       h['no_role'] = { code: 404 }
@@ -981,7 +981,7 @@
         }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: package_model_response_object)
+        h = Hash.new({ code: 200, response_object: package_model_response_object }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -1077,7 +1077,7 @@
       let(:org) { space.organization }
       let(:user) { VCAP::CloudController::User.make }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 302)
+        h = Hash.new({ code: 302 }.freeze)
         h['global_auditor'] = { code: 403 }
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
@@ -1145,7 +1145,7 @@
       let(:org) { space.organization }
       let(:user) { VCAP::CloudController::User.make }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200)
+        h = Hash.new({ code: 200 }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -1237,7 +1237,7 @@
       let(:org) { space.organization }
       let(:user) { VCAP::CloudController::User.make }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 202)
+        h = Hash.new({ code: 202 }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
diff --git a/spec/request/processes_spec.rb b/spec/request/processes_spec.rb
index 6c8590b22ec..8b9a0308d77 100644
--- a/spec/request/processes_spec.rb
+++ b/spec/request/processes_spec.rb
@@ -386,7 +386,7 @@
       let(:api_call) { ->(user_headers) { get '/v3/processes', nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_guids: [web_process.guid, worker_process.guid])
+        h = Hash.new({ code: 200, response_guids: [web_process.guid, worker_process.guid] }.freeze)
         h['org_auditor'] = { code: 200, response_guids: [] }
         h['org_billing_manager'] = { code: 200, response_guids: [] }
         h['no_role'] = { code: 200, response_objects: [] }
@@ -480,7 +480,7 @@
       let(:api_call) { ->(user_headers) { get "/v3/processes/#{process.guid}", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response.merge({ 'command' => '[PRIVATE DATA HIDDEN]' }))
+        h = Hash.new({ code: 200, response_object: expected_response.merge({ 'command' => '[PRIVATE DATA HIDDEN]' }) }.freeze)
         h['space_developer'] = { code: 200, response_object: expected_response }
         h['admin'] = { code: 200, response_object: expected_response }
         h['admin_read_only'] = { code: 200, response_object: expected_response }
@@ -640,7 +640,7 @@
       let(:api_call) { ->(user_headers) { get "/v3/processes/#{process.guid}/stats", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response)
+        h = Hash.new({ code: 200, response_object: expected_response }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404, response_object: [] }
         h['no_role'] = { code: 404, response_object: [] }
@@ -745,7 +745,7 @@
       let(:api_call) { ->(user_headers) { patch "/v3/processes/#{process.guid}", update_request, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200, response_object: expected_response }
         h['space_developer'] = { code: 200, response_object: expected_response }
         h['space_supporter'] = { code: 200, response_object: expected_response }
@@ -940,7 +940,7 @@
       let(:api_call) { ->(user_headers) { post "/v3/processes/#{process.guid}/actions/scale", scale_request.to_json, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 202, response_object: expected_response }
         h['space_developer'] = { code: 202, response_object: expected_response }
         h['space_supporter'] = { code: 202, response_object: expected_response }
@@ -1131,7 +1131,7 @@
       let(:api_call) { ->(user_headers) { delete "/v3/processes/#{process.guid}/instances/0", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 204 }
         h['space_developer'] = { code: 204 }
         h['space_supporter'] = { code: 204 }
@@ -1364,7 +1364,7 @@
       let(:expected_guids) { [process1.guid, process2.guid, process3.guid, deployment_process.guid] }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_guids: expected_guids)
+        h = Hash.new({ code: 200, response_guids: expected_guids }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404, response_guids: nil }
         h['no_role'] = { code: 404, response_guids: nil }
@@ -1460,7 +1460,7 @@
       let(:api_call) { ->(user_headers) { get "/v3/apps/#{app_model.guid}/processes/web", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response.merge({ 'command' => '[PRIVATE DATA HIDDEN]' }))
+        h = Hash.new({ code: 200, response_object: expected_response.merge({ 'command' => '[PRIVATE DATA HIDDEN]' }) }.freeze)
         h['space_developer'] = { code: 200, response_object: expected_response }
         h['admin'] = { code: 200, response_object: expected_response }
         h['admin_read_only'] = { code: 200, response_object: expected_response }
@@ -1829,7 +1829,7 @@
       let(:api_call) { ->(user_headers) { delete "/v3/apps/#{app_model.guid}/processes/web/instances/0", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = { code: 204 }
         h['space_developer'] = { code: 204 }
         h['space_supporter'] = { code: 204 }
diff --git a/spec/request/revisions_spec.rb b/spec/request/revisions_spec.rb
index b7ccdb6d12b..d3ace2cf840 100644
--- a/spec/request/revisions_spec.rb
+++ b/spec/request/revisions_spec.rb
@@ -65,7 +65,7 @@
       }
     end
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 200, response_object: revision_model_response_object)
+      h = Hash.new({ code: 200, response_object: revision_model_response_object }.freeze)
       h['org_auditor'] = { code: 404 }
       h['org_billing_manager'] = { code: 404 }
       h['no_role'] = { code: 404 }
@@ -160,7 +160,7 @@
         let(:message) { VCAP::CloudController::AppRevisionsListMessage }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_objects: revision_response_objects)
+          h = Hash.new({ code: 200, response_objects: revision_response_objects }.freeze)
           h['org_auditor'] = { code: 404 }
           h['org_billing_manager'] = { code: 404 }
           h['no_role'] = { code: 404 }
@@ -508,7 +508,7 @@
     context 'permissions' do
       let(:api_call) { ->(user_headers) { patch "/v3/revisions/#{revision.guid}", update_request, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer].each { |r| h[r] = { code: 200 } }
         h
@@ -658,7 +658,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: revision_response_objects)
+        h = Hash.new({ code: 200, response_objects: revision_response_objects }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
diff --git a/spec/request/roles_spec.rb b/spec/request/roles_spec.rb
index fde2dc455be..75f283e88b3 100644
--- a/spec/request/roles_spec.rb
+++ b/spec/request/roles_spec.rb
@@ -67,7 +67,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = {
           code: 201,
           response_object: expected_response
@@ -217,7 +217,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = {
           code: 201,
           response_object: expected_response
@@ -336,7 +336,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = h['org_manager'] = {
             code: 201,
             response_object: expected_response
@@ -397,7 +397,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = {
             code: 201,
             response_object: expected_response
@@ -517,7 +517,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = {
             code: 201,
             response_object: expected_response
@@ -649,7 +649,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = {
           code: 201,
           response_object: expected_response
@@ -696,7 +696,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = {
             code: 201,
             response_object: expected_response
@@ -778,7 +778,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -799,7 +799,7 @@
           end
 
           let(:expected_codes_and_responses) do
-            h = Hash.new(code: 403)
+            h = Hash.new({ code: 403 }.freeze)
             h['admin'] = {
               code: 201,
               response_object: expected_response
@@ -897,7 +897,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -1238,7 +1238,7 @@ def make_space_role_for_current_user(type)
 
     context 'listing all roles' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: [space_auditor_response_object, org_auditor_response_object])
+        h = Hash.new({ code: 200, response_objects: [space_auditor_response_object, org_auditor_response_object] }.freeze)
 
         h['org_auditor'] = {
           code: 200,
@@ -1334,7 +1334,7 @@ def make_space_role_for_current_user(type)
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: [org_auditor_response_object, space_auditor_response_object])
+        h = Hash.new({ code: 200, response_objects: [org_auditor_response_object, space_auditor_response_object] }.freeze)
         h['org_auditor'] = {
           code: 200,
           response_objects: contain_exactly(
@@ -1639,7 +1639,7 @@ def make_space_role_for_current_user(type)
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response)
+        h = Hash.new({ code: 200, response_object: expected_response }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -1682,7 +1682,7 @@ def make_space_role_for_current_user(type)
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response)
+        h = Hash.new({ code: 200, response_object: expected_response }.freeze)
         h['no_role'] = { code: 404 }
         h
       end
@@ -1838,7 +1838,7 @@ def make_space_role_for_current_user(type)
       let(:role) { VCAP::CloudController::SpaceAuditor.make(user: user_with_role, space: space) }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 202 }
         h['space_manager'] = { code: 202 }
         h['org_manager'] = { code: 202 }
@@ -1869,7 +1869,7 @@ def make_space_role_for_current_user(type)
       let(:role) { VCAP::CloudController::OrganizationAuditor.make(user: user_with_role, organization: org) }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 202 }
         h['org_manager'] = { code: 202 }
         h['no_role'] = { code: 404 }
diff --git a/spec/request/route_destinations_spec.rb b/spec/request/route_destinations_spec.rb
index 82eb7fa7ddc..fa0245a3c99 100644
--- a/spec/request/route_destinations_spec.rb
+++ b/spec/request/route_destinations_spec.rb
@@ -158,8 +158,8 @@
     context 'when the user is a member in the routes org' do
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_object: response_json
+          { code: 200,
+            response_object: response_json }.freeze
         )
 
         h['org_billing_manager'] = { code: 404 }
@@ -291,7 +291,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200, response_object: response_json }
         h['space_developer'] = { code: 200, response_object: response_json }
         h['space_supporter'] = { code: 200, response_object: response_json }
@@ -801,7 +801,7 @@
         }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200, response_object: response_json }
         h['space_developer'] = { code: 200, response_object: response_json }
         h['space_supporter'] = { code: 200, response_object: response_json }
@@ -1244,7 +1244,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200 }
         h['space_developer'] = { code: 200 }
         h['space_supporter'] = { code: 200 }
@@ -1367,7 +1367,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 204 }
         h['space_developer'] = { code: 204 }
         h['space_supporter'] = { code: 204 }
diff --git a/spec/request/routes_spec.rb b/spec/request/routes_spec.rb
index 5a22276e405..e7bac24ded4 100644
--- a/spec/request/routes_spec.rb
+++ b/spec/request/routes_spec.rb
@@ -172,8 +172,8 @@
     context 'when the user is a member in the routes org' do
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_objects: [route_in_org_json]
+          { code: 200,
+            response_objects: [route_in_org_json] }.freeze
         )
 
         h['admin'] = { code: 200, response_objects: [route_in_org_json, route_in_other_org_json] }
@@ -996,8 +996,8 @@
     context 'when the user is a member in the routes org' do
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_object: route_json
+          { code: 200,
+            response_object: route_json }.freeze
         )
 
         h['org_billing_manager'] = { code: 404 }
@@ -1231,7 +1231,7 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 403
+              { code: 403 }.freeze
             )
             h['admin'] = {
               code: 201,
@@ -1312,7 +1312,7 @@
 
             let(:expected_codes_and_responses) do
               h = Hash.new(
-                code: 403
+                { code: 403 }.freeze
               )
               h['admin'] = {
                 code: 201,
@@ -1397,7 +1397,7 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 403
+              { code: 403 }.freeze
             )
             h['admin'] = {
               code: 201,
@@ -1496,7 +1496,7 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 403
+              { code: 403 }.freeze
             )
             h['admin'] = {
               code: 201,
@@ -1570,7 +1570,7 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 403
+              { code: 403 }.freeze
             )
             h['admin'] = {
               code: 201,
@@ -1655,7 +1655,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -1798,7 +1798,7 @@
         let(:api_call) { ->(user_headers) { post '/v3/routes', params.to_json, user_headers } }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = {
             code: 201,
             response_object: route_json
@@ -1912,7 +1912,7 @@
 
           let(:expected_codes_and_responses) do
             h = Hash.new(
-              code: 403
+              { code: 403 }.freeze
             )
             h['admin'] = {
               code: 201,
@@ -2143,7 +2143,7 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 403
+          { code: 403 }.freeze
         )
         h['admin'] = {
           code: 201,
@@ -2460,7 +2460,7 @@
 
     context 'when the user logged in' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200, response_object: route_json }
         h['no_role'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
@@ -2530,7 +2530,7 @@
         }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = {
           code: 200,
           response_object: route_json
@@ -2623,7 +2623,7 @@
 
     context 'when the user is a member in the routes org' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
         h['admin'] = { code: 202 }
@@ -2695,16 +2695,16 @@
     describe 'permissions' do
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_object: {
-                         data: [
-                           {
-                             guid: target_space_1.guid
-                           }
-                         ],
-                         links: {
-                           self: { href: %r{#{Regexp.escape(link_prefix)}/v3/routes/#{route.guid}/relationships/shared_spaces} }
-                         }
-                       })
+          h = Hash.new({ code: 200, response_object: {
+            data: [
+              {
+                guid: target_space_1.guid
+              }
+            ],
+            links: {
+              self: { href: %r{#{Regexp.escape(link_prefix)}/v3/routes/#{route.guid}/relationships/shared_spaces} }
+            }
+          } }.freeze)
 
           h['org_billing_manager'] = { code: 404 }
           h['no_role'] = { code: 404 }
@@ -2781,7 +2781,7 @@
 
     describe 'permissions' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
 
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -3073,7 +3073,7 @@
 
     describe 'permissions' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
 
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -3305,7 +3305,7 @@
 
     context 'when the user logged in' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200 }
         h['no_role'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
@@ -3678,8 +3678,8 @@
     context 'when the user is a member in the app space' do
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_objects: [route1_json, route2_json]
+          { code: 200,
+            response_objects: [route1_json, route2_json] }.freeze
         )
 
         h['org_auditor'] = { code: 404 }
diff --git a/spec/request/security_groups_spec.rb b/spec/request/security_groups_spec.rb
index cde36343bf3..3f7f6361519 100644
--- a/spec/request/security_groups_spec.rb
+++ b/spec/request/security_groups_spec.rb
@@ -72,7 +72,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = {
           code: 201,
           response_object: expected_response
@@ -227,7 +227,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = {
             code: 200,
             response_object: expected_response
@@ -270,7 +270,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = h['space_manager'] = h['org_manager'] = {
             code: 200,
             response_object: expected_response
@@ -325,7 +325,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = h['space_manager'] = h['org_manager'] = {
             code: 200,
             response_object: expected_response
@@ -392,7 +392,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = {
             code: 200,
             response_object: expected_response
@@ -435,7 +435,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = h['space_manager'] = h['org_manager'] = {
             code: 200,
             response_object: expected_response
@@ -490,7 +490,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = h['space_manager'] = h['org_manager'] = {
             code: 200,
             response_object: expected_response
@@ -676,7 +676,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: [])
+        h = Hash.new({ code: 200, response_objects: [] }.freeze)
         h['admin'] = {
           code: 200,
           response_objects: contain_exactly(expected_response_1, expected_response_2, expected_response_3, expected_response_dummy_1, expected_response_dummy_2)
@@ -832,7 +832,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = {
           code: 200,
           response_object: expected_response
@@ -884,7 +884,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = {
           code: 200,
           response_object: expected_response
@@ -952,7 +952,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 200, response_object: expected_response)
+        Hash.new({ code: 200, response_object: expected_response }.freeze)
       end
 
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS
@@ -1031,7 +1031,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = {
           code: 200,
           response_object: expected_response
@@ -1075,7 +1075,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = {
           code: 200,
           response_object: expected_response
@@ -1126,7 +1126,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = {
           code: 200,
           response_object: expected_response
@@ -1238,7 +1238,7 @@
     context 'unbinding a running security group from a space' do
       context 'when the security group is NOT globally enabled NOR associated with any spaces' do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = { code: 422 }
           h['admin_read_only'] = { code: 403 }
           h['global_auditor'] = { code: 403 }
@@ -1260,7 +1260,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = { code: 204 }
           h['space_manager'] = { code: 204 }
           h['org_manager'] = { code: 204 }
@@ -1286,7 +1286,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = { code: 204 }
           h['space_manager'] = { code: 204 }
           h['org_manager'] = { code: 204 }
@@ -1337,7 +1337,7 @@
     context 'unbinding a staging security group from a space' do
       context 'when the security group is NOT globally enabled NOR associated with any spaces' do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = { code: 422 }
           h['admin_read_only'] = { code: 403 }
           h['global_auditor'] = { code: 403 }
@@ -1359,7 +1359,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = { code: 204 }
           h['space_manager'] = { code: 204 }
           h['org_manager'] = { code: 204 }
@@ -1385,7 +1385,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = { code: 204 }
           h['space_manager'] = { code: 204 }
           h['org_manager'] = { code: 204 }
@@ -1453,7 +1453,7 @@
       let(:security_group) { VCAP::CloudController::SecurityGroup.make(running_default: true) }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = { code: 202 }
         h
       end
@@ -1465,7 +1465,7 @@
       let(:security_group) { VCAP::CloudController::SecurityGroup.make }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = { code: 202 }
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
@@ -1484,7 +1484,7 @@
       let(:security_group) { VCAP::CloudController::SecurityGroup.make }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = { code: 202 }
         h['global_auditor'] = { code: 403 }
         h['admin_read_only'] = { code: 403 }
diff --git a/spec/request/service_brokers_spec.rb b/spec/request/service_brokers_spec.rb
index 486a6bb7124..45226eb3351 100644
--- a/spec/request/service_brokers_spec.rb
+++ b/spec/request/service_brokers_spec.rb
@@ -132,8 +132,8 @@
     describe 'empty response' do
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_objects: []
+          { code: 200,
+            response_objects: [] }.freeze
         )
 
         h
@@ -201,8 +201,8 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_objects: []
+          { code: 200,
+            response_objects: [] }.freeze
         )
 
         h['admin'] = { code: 200, response_objects: [broker_created_with_v3_json, broker_created_with_v2_json] }
@@ -243,8 +243,8 @@
       end
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_objects: []
+          { code: 200,
+            response_objects: [] }.freeze
         )
 
         h['admin'] = {
@@ -381,7 +381,7 @@ def expect_empty_list(user_headers)
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
 
         h['admin'] = {
           code: 200,
@@ -431,7 +431,7 @@ def expect_empty_list(user_headers)
         }
       end
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
 
         h['admin'] = {
           code: 200,
@@ -494,7 +494,7 @@ def expect_empty_list(user_headers)
         it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS do
           let(:api_call) { ->(user_headers) { patch "/v3/service_brokers/#{broker.guid}", update_request_body.to_json, user_headers } }
           let(:expected_codes_and_responses) do
-            Hash.new(code: 404).tap do |h|
+            Hash.new({ code: 404 }.freeze).tap do |h|
               h['admin'] = { code: 202 }
               h['admin_read_only'] = { code: 403 }
               h['global_auditor'] = { code: 403 }
@@ -1028,7 +1028,7 @@ def expect_empty_list(user_headers)
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS do
         let(:api_call) { ->(user_headers) { post '/v3/service_brokers', global_broker_request_body.to_json, user_headers } }
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = { code: 202 }
           end
         end
@@ -1466,7 +1466,7 @@ def assert_broker_state(broker_json)
 
           it_behaves_like 'permissions for delete endpoint', ALL_PERMISSIONS do
             let(:expected_codes_and_responses) do
-              Hash.new(code: 404).tap do |h|
+              Hash.new({ code: 404 }.freeze).tap do |h|
                 h['admin'] = { code: 202 }
                 h['admin_read_only'] = { code: 403 }
                 h['global_auditor'] = { code: 403 }
diff --git a/spec/request/service_credential_bindings_spec.rb b/spec/request/service_credential_bindings_spec.rb
index c7934140f67..f1f5d3c4ba2 100644
--- a/spec/request/service_credential_bindings_spec.rb
+++ b/spec/request/service_credential_bindings_spec.rb
@@ -115,8 +115,8 @@
 
         let(:expected_codes_and_responses) do
           Hash.new(
-            code: 200,
-            response_objects: []
+            { code: 200,
+              response_objects: [] }.freeze
           ).tap do |h|
             h['admin'] = all_bindings
             h['admin_read_only'] = all_bindings
@@ -506,7 +506,7 @@ def check_filtered_bindings(*bindings)
       let(:api_call) { ->(user_headers) { get '/v3/service_credential_bindings/no-binding', nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404)
+        Hash.new({ code: 404 }.freeze)
       end
 
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS
@@ -721,7 +721,7 @@ def check_filtered_bindings(*bindings)
     context 'permissions' do
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404, response_object: binding_credentials)
+          h = Hash.new({ code: 404, response_object: binding_credentials }.freeze)
           h['admin'] = h['admin_read_only'] = h['space_developer'] = { code: 200 }
           h
         end
@@ -2428,7 +2428,7 @@ def check_filtered_bindings(*bindings)
             end
 
             let(:expected_codes_and_responses) do
-              h = Hash.new(code: 404)
+              h = Hash.new({ code: 404 }.freeze)
               h['admin'] = { code: 202 }
               h['admin_read_only'] = h['global_auditor'] = { code: 403 }
               h
diff --git a/spec/request/service_instances_spec.rb b/spec/request/service_instances_spec.rb
index 65561bfe5a9..d84aaacc4ff 100644
--- a/spec/request/service_instances_spec.rb
+++ b/spec/request/service_instances_spec.rb
@@ -16,7 +16,7 @@
       let(:guid) { 'no-such-guid' }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404)
+        Hash.new({ code: 404 }.freeze)
       end
 
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS
@@ -248,8 +248,8 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: []
+            { code: 200,
+              response_objects: [] }.freeze
           )
 
           h['admin'] = all_instances
@@ -527,8 +527,8 @@ def check_filtered_instances(*instances)
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_object: credentials
+          { code: 200,
+            response_object: credentials }.freeze
         )
 
         h['global_auditor'] = h['space_supporter'] = h['space_manager'] = h['space_auditor'] = h['org_manager'] = { code: 403 }
@@ -594,8 +594,8 @@ def check_filtered_instances(*instances)
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_object: parameters
+          { code: 200,
+            response_object: parameters }.freeze
         )
 
         h['org_auditor'] = { code: 404 }
@@ -703,8 +703,8 @@ def check_filtered_instances(*instances)
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_object: parameters
+            { code: 200,
+              response_object: parameters }.freeze
           )
 
           h['space_supporter'] = h['space_developer'] = h['space_manager'] = h['space_auditor'] = h['org_manager'] = { code: 403 }
@@ -4237,7 +4237,7 @@ def create_bindings(instance, space:, count:)
       let(:guid) { 'no-such-guid' }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['unauthenticated'] = { code: 401 }
         h
       end
@@ -4250,7 +4250,7 @@ def create_bindings(instance, space:, count:)
       let(:guid) { instance.guid }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         %w[admin space_developer].each { |r| h[r] = READ_AND_WRITE }
         %w[admin_read_only global_auditor org_manager space_manager space_auditor space_supporter].each { |r| h[r] = READ_ONLY }
         %w[org_billing_manager org_auditor no_role service_permissions_reader].each { |r| h[r] = NO_PERMISSIONS }
@@ -4299,7 +4299,7 @@ def create_bindings(instance, space:, count:)
       let(:guid) { instance.guid }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = READ_AND_WRITE
         %w[admin_read_only global_auditor].each { |r| h[r] = READ_ONLY }
         %w[org_billing_manager org_auditor org_manager space_manager space_auditor space_developer space_supporter no_role service_permissions_reader].each do |r|
diff --git a/spec/request/service_offerings_spec.rb b/spec/request/service_offerings_spec.rb
index e0eeab83746..a61d0c77fa2 100644
--- a/spec/request/service_offerings_spec.rb
+++ b/spec/request/service_offerings_spec.rb
@@ -23,7 +23,7 @@
       let(:api_call) { ->(user_headers) { get '/v3/service_offerings/does-not-exist-guid', nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404)
+        Hash.new({ code: 404 }.freeze)
       end
 
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS + UNAUTHENTICATED
@@ -34,7 +34,7 @@
       let(:service_offering) { service_plan.service }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = successful_response
         h['admin_read_only'] = successful_response
         h['global_auditor'] = successful_response
@@ -127,7 +127,7 @@
         let(:space) { VCAP::CloudController::Space.make(organization: org) }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = successful_response
           h['admin_read_only'] = successful_response
           h['global_auditor'] = successful_response
@@ -283,10 +283,10 @@
 
       let(:expected_codes_and_responses) do
         Hash.new(
-          code: 200,
-          response_objects: [
-            create_offering_json(public_service_offering)
-          ]
+          { code: 200,
+            response_objects: [
+              create_offering_json(public_service_offering)
+            ] }.freeze
         ).tap do |h|
           h['admin'] = all_offerings_response
           h['admin_read_only'] = all_offerings_response
@@ -654,7 +654,7 @@
       let(:guid) { 'non-existing-guid' }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404).tap do |h|
+        Hash.new({ code: 404 }.freeze).tap do |h|
           h['unauthenticated'] = { code: 401 }
         end
       end
@@ -667,7 +667,7 @@
       let(:guid) { service_offering.guid }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404).tap do |h|
+        Hash.new({ code: 404 }.freeze).tap do |h|
           h['admin'] = { code: 204 }
           h['admin_read_only'] = { code: 403 }
           h['global_auditor'] = { code: 403 }
@@ -692,7 +692,7 @@
       let(:guid) { service_offering.guid }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 403).tap do |h|
+        Hash.new({ code: 403 }.freeze).tap do |h|
           h['admin'] = { code: 422 }
           h['unauthenticated'] = { code: 401 }
         end
@@ -711,7 +711,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 403).tap do |h|
+        Hash.new({ code: 403 }.freeze).tap do |h|
           h['admin'] = { code: 422 }
           h['no_role'] = { code: 404 }
           h['unauthenticated'] = { code: 401 }
@@ -737,7 +737,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404).tap do |h|
+        Hash.new({ code: 404 }.freeze).tap do |h|
           h['admin'] = { code: 204 }
           h['admin_read_only'] = { code: 403 }
           h['global_auditor'] = { code: 403 }
@@ -892,7 +892,7 @@
         let!(:service_offering) { VCAP::CloudController::Service.make(active: true) }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 404).tap do |h|
+          Hash.new({ code: 404 }.freeze).tap do |h|
             h['admin'] = {
               code: 200,
               response_object: create_offering_json(service_offering, labels:, annotations:)
@@ -910,7 +910,7 @@
         let!(:service_offering) { VCAP::CloudController::ServicePlan.make(public: true, active: true).service }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = {
               code: 200,
               response_object: create_offering_json(service_offering, labels:, annotations:)
@@ -931,7 +931,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = {
               code: 200,
               response_object: create_offering_json(service_offering, labels:, annotations:)
@@ -957,7 +957,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 404).tap do |h|
+          Hash.new({ code: 404 }.freeze).tap do |h|
             h['admin'] = {
               code: 200,
               response_object: create_offering_json(service_offering, labels:, annotations:)
diff --git a/spec/request/service_plan_visibility_spec.rb b/spec/request/service_plan_visibility_spec.rb
index 3db50b93878..8ebd9bc4d26 100644
--- a/spec/request/service_plan_visibility_spec.rb
+++ b/spec/request/service_plan_visibility_spec.rb
@@ -26,8 +26,8 @@
       let!(:service_plan) { VCAP::CloudController::ServicePlan.make }
       let(:expected_codes_and_responses) do
         Hash.new(
-          code: 200,
-          response_object: { 'type' => 'public' }
+          { code: 200,
+            response_object: { 'type' => 'public' } }.freeze
         )
       end
 
@@ -43,7 +43,7 @@
         }
       end
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404).tap do |h|
+        Hash.new({ code: 404 }.freeze).tap do |h|
           h['admin'] = admin_only_response
           h['admin_read_only'] = admin_only_response
           h['global_auditor'] = admin_only_response
@@ -158,7 +158,7 @@
       let(:service_plan) { VCAP::CloudController::ServicePlan.make(public: false) }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404).tap do |h|
+        Hash.new({ code: 404 }.freeze).tap do |h|
           h['admin'] = successful_response
           h['admin_read_only'] = { code: 403 }
           h['global_auditor'] = { code: 403 }
@@ -191,7 +191,7 @@
     context 'when the plan current visibility is "public"' do
       let(:service_plan) { VCAP::CloudController::ServicePlan.make(public: true) }
       let(:expected_codes_and_responses) do
-        Hash.new(code: 403).tap do |h|
+        Hash.new({ code: 403 }.freeze).tap do |h|
           h['admin'] = successful_response
           h['unauthenticated'] = { code: 401 }
         end
@@ -252,7 +252,7 @@
       context 'and its being updated to "public"' do
         let(:successful_response) { { code: 200, response_object: { type: 'public' } } }
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = successful_response
             h['unauthenticated'] = { code: 401 }
             h['no_role'] = { code: 404 }
@@ -282,7 +282,7 @@
         let(:req_body) { { type: 'admin' } }
         let(:successful_response) { { code: 200, response_object: { type: 'admin' } } }
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = successful_response
             h['no_role'] = { code: 404 }
             h['unauthenticated'] = { code: 401 }
@@ -544,7 +544,7 @@
       let(:req_body) { { type: 'organization', organizations: [{ guid: third_org.guid }] } }
       let(:successful_response) { { code: 200, response_object: { type: 'organization' } } }
       let(:expected_codes_and_responses) do
-        Hash.new(code: 403).tap do |h|
+        Hash.new({ code: 403 }.freeze).tap do |h|
           h['admin'] = successful_response
           h['unauthenticated'] = { code: 401 }
           h['no_role'] = { code: 404 }
@@ -623,7 +623,7 @@
 
       let(:successful_response) { { code: 204 } }
       let(:expected_codes_and_responses) do
-        Hash.new(code: 403).tap do |h|
+        Hash.new({ code: 403 }.freeze).tap do |h|
           h['admin'] = successful_response
           h['unauthenticated'] = { code: 401 }
           h['no_role'] = { code: 404 }
diff --git a/spec/request/service_plans_spec.rb b/spec/request/service_plans_spec.rb
index 644b66b9e39..aaf5ba5963e 100644
--- a/spec/request/service_plans_spec.rb
+++ b/spec/request/service_plans_spec.rb
@@ -16,7 +16,7 @@
       let(:guid) { 'no-such-plan' }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404)
+        Hash.new({ code: 404 }.freeze)
       end
 
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS + UNAUTHENTICATED
@@ -34,8 +34,8 @@
 
       let(:expected_codes_and_responses) do
         Hash.new(
-          code: 200,
-          response_object: create_plan_json(service_plan, maintenance_info:)
+          { code: 200,
+            response_object: create_plan_json(service_plan, maintenance_info:) }.freeze
         )
       end
 
@@ -47,7 +47,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 401)
+          Hash.new({ code: 401 }.freeze)
         end
 
         it_behaves_like 'permissions for single object endpoint', UNAUTHENTICATED
@@ -61,7 +61,7 @@
         let(:guid) { service_plan.guid }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 200, response_object: create_plan_json(service_plan)).tap do |r|
+          Hash.new({ code: 200, response_object: create_plan_json(service_plan) }.freeze).tap do |r|
             r['unauthenticated'] = { code: 404 }
             r['no_role'] = { code: 404 }
           end
@@ -259,10 +259,10 @@
 
       let(:expected_codes_and_responses) do
         Hash.new(
-          code: 200,
-          response_objects: [
-            create_plan_json(public_service_plan)
-          ]
+          { code: 200,
+            response_objects: [
+              create_plan_json(public_service_plan)
+            ] }.freeze
         ).tap do |h|
           h['admin'] = all_plans_response
           h['admin_read_only'] = all_plans_response
@@ -285,7 +285,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 401)
+          Hash.new({ code: 401 }.freeze)
         end
 
         it_behaves_like 'permissions for list endpoint', UNAUTHENTICATED
@@ -666,7 +666,7 @@
       let(:guid) { 'non-existing-guid' }
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 404).tap do |h|
+        Hash.new({ code: 404 }.freeze).tap do |h|
           h['unauthenticated'] = { code: 401 }
         end
       end
@@ -681,7 +681,7 @@
         let!(:service_plan) { VCAP::CloudController::ServicePlan.make(public: false) }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 404).tap do |h|
+          Hash.new({ code: 404 }.freeze).tap do |h|
             h['admin'] = { code: 204 }
             h['admin_read_only'] = { code: 403 }
             h['global_auditor'] = { code: 403 }
@@ -696,7 +696,7 @@
         let!(:service_plan) { VCAP::CloudController::ServicePlan.make }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = { code: 204 }
             h['unauthenticated'] = { code: 401 }
           end
@@ -713,7 +713,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = { code: 204 }
             h['no_role'] = { code: 404 }
             h['unauthenticated'] = { code: 401 }
@@ -729,7 +729,7 @@
         let!(:service_plan) { VCAP::CloudController::ServicePlan.make(service: service_offering, public: false) }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 404).tap do |h|
+          Hash.new({ code: 404 }.freeze).tap do |h|
             h['admin'] = { code: 204 }
             h['admin_read_only'] = { code: 403 }
             h['global_auditor'] = { code: 403 }
@@ -832,7 +832,7 @@
         let!(:service_plan) { VCAP::CloudController::ServicePlan.make(public: false) }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 404).tap do |h|
+          Hash.new({ code: 404 }.freeze).tap do |h|
             h['admin'] = { code: 200, response_object: create_plan_json(service_plan, labels:, annotations:) }
             h['admin_read_only'] = { code: 403 }
             h['global_auditor'] = { code: 403 }
@@ -847,7 +847,7 @@
         let!(:service_plan) { VCAP::CloudController::ServicePlan.make }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = { code: 200, response_object: create_plan_json(service_plan, labels:, annotations:) }
             h['unauthenticated'] = { code: 401 }
           end
@@ -864,7 +864,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403).tap do |h|
+          Hash.new({ code: 403 }.freeze).tap do |h|
             h['admin'] = { code: 200, response_object: create_plan_json(service_plan, labels:, annotations:) }
             h['no_role'] = { code: 404 }
             h['unauthenticated'] = { code: 401 }
@@ -880,7 +880,7 @@
         let!(:service_plan) { VCAP::CloudController::ServicePlan.make(service: service_offering, public: false) }
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 404).tap do |h|
+          Hash.new({ code: 404 }.freeze).tap do |h|
             h['admin'] = { code: 200, response_object: create_plan_json(service_plan, labels:, annotations:) }
             h['admin_read_only'] = { code: 403 }
             h['global_auditor'] = { code: 403 }
diff --git a/spec/request/service_route_bindings_spec.rb b/spec/request/service_route_bindings_spec.rb
index 94973166d4e..49f4bf67cf7 100644
--- a/spec/request/service_route_bindings_spec.rb
+++ b/spec/request/service_route_bindings_spec.rb
@@ -68,7 +68,7 @@
     describe 'no bindings to list' do
       let(:api_call) { ->(user_headers) { get '/v3/service_route_bindings', nil, user_headers } }
       let(:expected_codes_and_responses) do
-        Hash.new(code: 200, response_objects: [])
+        Hash.new({ code: 200, response_objects: [] }.freeze)
       end
 
       it_behaves_like 'permissions for list endpoint', ALL_PERMISSIONS
@@ -116,7 +116,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        Hash.new(code: 200, response_objects: []).tap do |h|
+        Hash.new({ code: 200, response_objects: [] }.freeze).tap do |h|
           h['admin'] = bindings_response_body
           h['admin_read_only'] = bindings_response_body
           h['global_auditor'] = bindings_response_body
@@ -1610,7 +1610,7 @@
 
       context 'permissions' do
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403, errors: CF_NOT_AUTHORIZED).tap do |h|
+          Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze).tap do |h|
             h['admin'] = parameters_response
             h['admin_readonly'] = parameters_response
             h['space_developer'] = parameters_response
@@ -1772,7 +1772,7 @@
 
       context 'permissions' do
         let(:expected_codes_and_responses) do
-          Hash.new(code: 403, errors: CF_NOT_AUTHORIZED).tap do |h|
+          Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze).tap do |h|
             h['admin'] = { code: 400, response_object: error_response }
             h['admin_readonly'] = { code: 400, response_object: error_response }
             h['space_developer'] = { code: 400, response_object: error_response }
diff --git a/spec/request/service_usage_events_spec.rb b/spec/request/service_usage_events_spec.rb
index 7fc0056c5a5..3accf28c0fd 100644
--- a/spec/request/service_usage_events_spec.rb
+++ b/spec/request/service_usage_events_spec.rb
@@ -16,8 +16,8 @@
 
     let(:expected_codes_and_responses) do
       h = Hash.new(
-        code: 404,
-        response_object: []
+        { code: 404,
+          response_object: [] }.freeze
       )
       h['admin'] = {
         code: 200,
@@ -76,8 +76,8 @@
 
     let(:expected_codes_and_responses) do
       h = Hash.new(
-        code: 200,
-        response_objects: []
+        { code: 200,
+          response_objects: [] }.freeze
       )
       h['admin'] = {
         code: 200,
@@ -181,7 +181,7 @@
     end
 
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 403)
+      h = Hash.new({ code: 403 }.freeze)
       h['admin'] = { code: 200 }
       h
     end
diff --git a/spec/request/sidecars_spec.rb b/spec/request/sidecars_spec.rb
index 4127eb0515f..b5f85a31df4 100644
--- a/spec/request/sidecars_spec.rb
+++ b/spec/request/sidecars_spec.rb
@@ -140,7 +140,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer].each { |r| h[r] = { code: 201 } }
         h
@@ -339,7 +339,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer].each { |r| h[r] = { code: 200 } }
         h
@@ -407,7 +407,7 @@
       let(:space) { app_model.space }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_guid: sidecar.guid)
+        h = Hash.new({ code: 200, response_guid: sidecar.guid }.freeze)
         h['no_role'] = {
           code: 404
         }
@@ -578,7 +578,7 @@
       let(:space) { app_model.space }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = {
           code: 200
         }
@@ -708,7 +708,7 @@
       let(:space) { app_model.space }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = {
           code: 200
         }
@@ -767,7 +767,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer].each { |r| h[r] = { code: 204 } }
         h
diff --git a/spec/request/space_features_spec.rb b/spec/request/space_features_spec.rb
index a361251c3f9..94a344b3ae8 100644
--- a/spec/request/space_features_spec.rb
+++ b/spec/request/space_features_spec.rb
@@ -73,7 +73,7 @@
 
     context 'permissions' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['admin'] = { code: 200, response_object: space_ssh_feature_json }
         h['space_manager'] = { code: 200, response_object: space_ssh_feature_json }
         h['org_manager'] = { code: 200, response_object: space_ssh_feature_json }
diff --git a/spec/request/space_manifests_spec.rb b/spec/request/space_manifests_spec.rb
index 55d3ca92fcd..f43a88ad56a 100644
--- a/spec/request/space_manifests_spec.rb
+++ b/spec/request/space_manifests_spec.rb
@@ -124,7 +124,7 @@
       let(:api_call) { ->(user_headers) { post "/v3/spaces/#{space.guid}/actions/apply_manifest", yml_manifest, yml_headers(user_headers) } }
       let(:org) { space.organization }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
@@ -1074,7 +1074,7 @@
       let(:api_call) { ->(user_headers) { post "/v3/spaces/#{space.guid}/manifest_diff", yml_manifest, yml_headers(user_headers) } }
       let(:org) { space.organization }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         h['org_auditor'] = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
         h['no_role'] = { code: 404 }
diff --git a/spec/request/space_quotas_spec.rb b/spec/request/space_quotas_spec.rb
index 277496bc098..07f844dc921 100644
--- a/spec/request/space_quotas_spec.rb
+++ b/spec/request/space_quotas_spec.rb
@@ -14,7 +14,7 @@ module VCAP::CloudController
 
       context 'when the space quota is applied to the space where the current user has a role' do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           expected_response = make_space_quota_json(space_quota)
           h['admin'] = { code: 200, response_object: expected_response }
           h['admin_read_only'] = { code: 200, response_object: expected_response }
@@ -35,7 +35,7 @@ module VCAP::CloudController
         let(:unapplied_space_quota) { VCAP::CloudController::SpaceQuotaDefinition.make(organization: org) }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = { code: 200, response_object: make_space_quota_json(unapplied_space_quota) }
           h['admin_read_only'] = { code: 200, response_object: make_space_quota_json(unapplied_space_quota) }
           h['global_auditor'] = { code: 200, response_object: make_space_quota_json(unapplied_space_quota) }
@@ -52,7 +52,7 @@ module VCAP::CloudController
         let(:other_space_quota) { VCAP::CloudController::SpaceQuotaDefinition.make(organization: other_org) }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = { code: 200, response_object: make_space_quota_json(other_space_quota) }
           h['admin_read_only'] = { code: 200, response_object: make_space_quota_json(other_space_quota) }
           h['global_auditor'] = { code: 200, response_object: make_space_quota_json(other_space_quota) }
@@ -143,7 +143,7 @@ module VCAP::CloudController
       context 'permissions' do
         let(:api_call) { ->(user_headers) { patch "/v3/space_quotas/#{space_quota.guid}", params.to_json, user_headers } }
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = { code: 200, response_object: updated_space_quota_json }
           h['org_manager'] = { code: 200, response_object: updated_space_quota_json }
           h['org_auditor'] = { code: 404 }
@@ -295,7 +295,7 @@ module VCAP::CloudController
         let!(:other_space_quota) { VCAP::CloudController::SpaceQuotaDefinition.make(organization: other_org, guid: 'other-space-quota') }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 200, response_objects: [])
+          h = Hash.new({ code: 200, response_objects: [] }.freeze)
           h['admin'] = {
             code: 200,
             response_objects: contain_exactly(
@@ -453,7 +453,7 @@ module VCAP::CloudController
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = {
             code: 201,
             response_object: space_quota_json
@@ -542,7 +542,7 @@ module VCAP::CloudController
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -762,7 +762,7 @@ module VCAP::CloudController
         end
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = { code: 200, response_object: data_json }
           h['org_manager'] = { code: 200, response_object: data_json }
           h['org_auditor'] = { code: 404 }
@@ -843,7 +843,7 @@ module VCAP::CloudController
 
       context 'when removing a space quota from a space' do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+          h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
           h['admin'] = { code: 204 }
           h['org_manager'] = { code: 204 }
           h['org_auditor'] = { code: 404 }
@@ -905,7 +905,7 @@ module VCAP::CloudController
         let!(:unapplied_space_quota) { VCAP::CloudController::SpaceQuotaDefinition.make(organization: org, guid: 'unapplied-space-quota') }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = { code: 202 }
           h['org_manager'] = { code: 202 }
           %w[admin_read_only global_auditor].each { |r| h[r] = { code: 403, errors: CF_NOT_AUTHORIZED } }
@@ -963,7 +963,7 @@ module VCAP::CloudController
         let(:api_call) { ->(user_headers) { delete "/v3/space_quotas/#{space_quota.guid}", {}, user_headers } }
 
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 403)
+          h = Hash.new({ code: 403 }.freeze)
           h['admin'] = { code: 422 }
           h['org_manager'] = { code: 422 }
           h['org_auditor'] = { code: 404 }
diff --git a/spec/request/spaces_spec.rb b/spec/request/spaces_spec.rb
index 437ff3349ed..589028b6cb1 100644
--- a/spec/request/spaces_spec.rb
+++ b/spec/request/spaces_spec.rb
@@ -72,7 +72,7 @@
       let(:space) { nil }
       let(:api_call) { ->(user_headers) { post '/v3/spaces', request_body, user_headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[admin org_manager].each { |r| h[r] = { code: 201 } }
         h['no_role'] = { code: 422 }
         h
@@ -228,7 +228,7 @@
       let(:api_call) { ->(user_headers) { get "/v3/spaces/#{space.guid}", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_guid: space.guid)
+        h = Hash.new({ code: 200, response_guid: space.guid }.freeze)
 
         h['org_auditor']         = { code: 404, response_guid: nil }
         h['org_billing_manager'] = { code: 404, response_guid: nil }
@@ -483,7 +483,7 @@
       let(:api_call) { ->(user_headers) { get '/v3/spaces', nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_guids: [space1.guid, space2.guid, space3.guid])
+        h = Hash.new({ code: 200, response_guids: [space1.guid, space2.guid, space3.guid] }.freeze)
 
         h['org_auditor']         = { code: 200, response_guids: [] }
         h['org_billing_manager'] = { code: 200, response_guids: [] }
@@ -637,7 +637,7 @@
       let(:global_sec_group) { VCAP::CloudController::SecurityGroup.make staging_default: true, name: 'global' }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = { code: 200, response_objects: response_object }
         h['admin_read_only'] = { code: 200, response_objects: response_object }
         h['global_auditor'] = { code: 200, response_objects: response_object }
@@ -789,7 +789,7 @@
       let(:unaffiliated_sec_group) { VCAP::CloudController::SecurityGroup.make }
       let(:global_sec_group) { VCAP::CloudController::SecurityGroup.make running_default: true, name: 'global' }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
         h['admin'] = { code: 200, response_objects: response_object }
         h['admin_read_only'] = { code: 200, response_objects: response_object }
         h['global_auditor'] = { code: 200, response_objects: response_object }
@@ -863,7 +863,7 @@
       let(:api_call) { ->(user_headers) { patch "/v3/spaces/#{space.guid}", request_body, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
 
         h['org_billing_manager'] = { code: 404 }
         h['org_auditor'] = { code: 404 }
@@ -1055,7 +1055,7 @@
 
     context 'when the user is a member in the spaces org' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
 
         h['org_billing_manager'] = { code: 404 }
         h['org_auditor'] = { code: 404 }
@@ -1130,7 +1130,7 @@
 
     context 'when the user is a member in the spaces org' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
 
         h['org_billing_manager'] = { code: 404 }
         h['org_auditor'] = { code: 404 }
@@ -1219,7 +1219,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response)
+        h = Hash.new({ code: 200, response_object: expected_response }.freeze)
 
         h['org_auditor']         = { code: 404, response_guid: nil }
         h['org_billing_manager'] = { code: 404, response_guid: nil }
@@ -1252,7 +1252,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['no_role']             = { code: 404 }
         h['org_auditor']         = { code: 404 }
         h['org_billing_manager'] = { code: 404 }
@@ -1510,11 +1510,11 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_objects: [
-            client_json,
-            current_user_json
-          ]
+          { code: 200,
+            response_objects: [
+              client_json,
+              current_user_json
+            ] }.freeze
         )
         h['no_role'] = {
           code: 404
diff --git a/spec/request/stacks_spec.rb b/spec/request/stacks_spec.rb
index 458e27bb1af..fd64bcd017e 100644
--- a/spec/request/stacks_spec.rb
+++ b/spec/request/stacks_spec.rb
@@ -56,7 +56,7 @@
         end
 
         let(:expected_codes_and_responses) do
-          Hash.new(code: 200, response_objects: stacks_response_objects)
+          Hash.new({ code: 200, response_objects: stacks_response_objects }.freeze)
         end
         let!(:stack1) { VCAP::CloudController::Stack.make }
         let!(:stack2) { VCAP::CloudController::Stack.make(name: default_stack_name) }
@@ -335,7 +335,7 @@
       }
     end
     let(:expected_codes_and_responses) do
-      Hash.new(code: 200, response_object: stacks_response_object)
+      Hash.new({ code: 200, response_object: stacks_response_object }.freeze)
     end
 
     it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS
@@ -548,7 +548,7 @@
       let(:api_call) { ->(user_headers) { get "/v3/stacks/#{stack.guid}/apps", nil, user_headers } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_guids: [app_model1.guid, app_model2.guid])
+        h = Hash.new({ code: 200, response_guids: [app_model1.guid, app_model2.guid] }.freeze)
 
         h['org_auditor'] = {
           code: 200,
diff --git a/spec/request/tasks_spec.rb b/spec/request/tasks_spec.rb
index 7a2446de59c..dff0094d06f 100644
--- a/spec/request/tasks_spec.rb
+++ b/spec/request/tasks_spec.rb
@@ -300,7 +300,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: expected_response)
+        h = Hash.new({ code: 200, response_objects: expected_response }.freeze)
         h['org_billing_manager'] = h['org_auditor'] = h['no_role'] = {
           code: 200,
           response_objects: []
@@ -460,7 +460,7 @@
       end
       let(:expected_response_with_command) { expected_response.merge({ 'command' => 'echo task' }) }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_object: expected_response)
+        h = Hash.new({ code: 200, response_object: expected_response }.freeze)
         h['admin'] = h['admin_read_only'] = h['space_developer'] = { code: 200, response_object: expected_response_with_command }
         h['org_auditor'] = h['org_billing_manager'] = h['no_role'] = { code: 404 }
         h
@@ -584,7 +584,7 @@
     context 'permissions' do
       let(:api_call) { ->(headers) { patch "/v3/tasks/#{task_guid}", request_body, headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer].each { |r| h[r] = { code: 200 } }
         h
@@ -660,7 +660,7 @@
       }
     end
     let(:expected_codes_and_responses) do
-      h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+      h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
       h['org_auditor'] = h['org_billing_manager'] = h['no_role'] = { code: 404 }
       h['admin'] = h['space_developer'] = h['space_supporter'] = {
         code: 202,
@@ -901,7 +901,7 @@
       let(:expected_response_with_command) { expected_response.map { |task| task.merge({ 'command' => 'echo task' }) } }
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 200, response_objects: expected_response)
+        h = Hash.new({ code: 200, response_objects: expected_response }.freeze)
         h['admin'] = h['admin_read_only'] = h['space_developer'] = { code: 200, response_objects: expected_response_with_command }
         h['org_auditor'] = h['org_billing_manager'] = h['no_role'] = { code: 404 }
         h
@@ -1289,7 +1289,7 @@
     context 'permissions' do
       let(:api_call) { ->(headers) { post "/v3/apps/#{app_model.guid}/tasks", body.to_json, headers } }
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403, errors: CF_NOT_AUTHORIZED)
+        h = Hash.new({ code: 403, errors: CF_NOT_AUTHORIZED }.freeze)
         %w[no_role org_auditor org_billing_manager].each { |r| h[r] = { code: 404 } }
         %w[admin space_developer].each { |r| h[r] = { code: 202 } }
         h
diff --git a/spec/request/users_spec.rb b/spec/request/users_spec.rb
index 9da5256fb74..9997a8bb6ce 100644
--- a/spec/request/users_spec.rb
+++ b/spec/request/users_spec.rb
@@ -157,10 +157,10 @@
       context 'when there are no other users in your space or org' do
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: [
-              current_user_json
-            ]
+            { code: 200,
+              response_objects: [
+                current_user_json
+              ] }.freeze
           )
           h['admin'] = {
             code: 200,
@@ -202,11 +202,11 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: [
-              actee_json,
-              current_user_json
-            ]
+            { code: 200,
+              response_objects: [
+                actee_json,
+                current_user_json
+              ] }.freeze
           )
           h['admin'] = {
             code: 200,
@@ -252,10 +252,10 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: [
-              current_user_json
-            ]
+            { code: 200,
+              response_objects: [
+                current_user_json
+              ] }.freeze
           )
           h
         end
@@ -288,10 +288,10 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: [
-              current_user_json
-            ]
+            { code: 200,
+              response_objects: [
+                current_user_json
+              ] }.freeze
           )
           h
         end
@@ -316,10 +316,10 @@
         let(:api_call) { ->(user_headers) { get endpoint, nil, user_headers } }
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 200,
-            response_objects: [
-              current_user_json
-            ]
+            { code: 200,
+              response_objects: [
+                current_user_json
+              ] }.freeze
           )
           h
         end
@@ -464,7 +464,7 @@
     context 'when the actee is not in an org or space' do
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 404
+          { code: 404 }.freeze
         )
         h['admin'] = {
           code: 200,
@@ -487,8 +487,8 @@
     context 'when the actee has an org or space role' do
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 200,
-          response_object: client_json
+          { code: 200,
+            response_object: client_json }.freeze
         )
         h['no_role'] = {
           code: 404,
@@ -652,7 +652,7 @@
 
       let(:expected_codes_and_responses) do
         h = Hash.new(
-          code: 403
+          { code: 403 }.freeze
         )
         h['admin'] = {
           code: 201,
@@ -695,7 +695,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -748,7 +748,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -794,7 +794,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -897,7 +897,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -940,7 +940,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 201,
@@ -1016,7 +1016,7 @@
 
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 422,
@@ -1082,7 +1082,7 @@
       context 'when the actee is not associated with any org or space' do
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 404
+            { code: 404 }.freeze
           )
           h['admin'] = {
             code: 200,
@@ -1104,7 +1104,7 @@
       context 'when the actee has an org or space role' do
         let(:expected_codes_and_responses) do
           h = Hash.new(
-            code: 403
+            { code: 403 }.freeze
           )
           h['admin'] = {
             code: 200,
@@ -1164,7 +1164,7 @@
 
     context 'when the actee is not associated with any org or space' do
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 404)
+        h = Hash.new({ code: 404 }.freeze)
 
         h['admin_read_only'] = { code: 403 }
         h['global_auditor'] = { code: 403 }
@@ -1181,7 +1181,7 @@
       end
 
       let(:expected_codes_and_responses) do
-        h = Hash.new(code: 403)
+        h = Hash.new({ code: 403 }.freeze)
         h['admin'] = { code: 202 }
         h['no_role'] = { code: 404 }
         h
@@ -1238,7 +1238,7 @@
     context 'permissions' do
       it_behaves_like 'permissions for single object endpoint', ALL_PERMISSIONS do
         let(:expected_codes_and_responses) do
-          h = Hash.new(code: 404)
+          h = Hash.new({ code: 404 }.freeze)
           h['admin'] = { code: 202 }
           h['admin_read_only'] = { code: 403 }
           h['global_auditor'] = { code: 403 }
diff --git a/spec/request/v2/auth_spec.rb b/spec/request/v2/auth_spec.rb
index 1d40bcb7aed..d4bd9cd2e4a 100644
--- a/spec/request/v2/auth_spec.rb
+++ b/spec/request/v2/auth_spec.rb
@@ -34,7 +34,7 @@
     let(:org) { VCAP::CloudController::Organization.make(created_at: 3.days.ago) }
     let(:space) { VCAP::CloudController::Space.make(organization: org) }
     let(:api_call) { ->(user_headers) { get '/v2/apps', nil, user_headers } }
-    let(:expected_codes_and_responses) { Hash.new(code: 200) }
+    let(:expected_codes_and_responses) { Hash.new({ code: 200 }.freeze) }
 
     before do
       space.organization.add_user(user)
diff --git a/spec/support/fake_uaa_server.rb b/spec/support/fake_uaa_server.rb
index f4a1300bafd..0256af58d54 100644
--- a/spec/support/fake_uaa_server.rb
+++ b/spec/support/fake_uaa_server.rb
@@ -8,7 +8,7 @@ def initialize(port)
       BindAddress: 'localhost',
       Port: port,
       AccessLog: [],
-      Logger: WEBrick::Log.new('/dev/null')
+      Logger: WEBrick::Log.new(File::NULL)
     )
 
     server.mount '/.well-known/openid-configuration', UAAIssuer
diff --git a/spec/support/integration/setup.rb b/spec/support/integration/setup.rb
index 0b6ef55cc33..3fd848ac361 100644
--- a/spec/support/integration/setup.rb
+++ b/spec/support/integration/setup.rb
@@ -58,8 +58,8 @@ def run_cmd(cmd, opts={})
 
       raise "`#{cmd}` exited with #{child_status} #{coredump_text(child_status)}\n#{failure_output(stdout, stderr)}" unless child_status.success? || opts[:continue_on_failure]
     else
-      spawn_opts[:out] = opts[:debug] ? :out : '/dev/null'
-      spawn_opts[:err] = opts[:debug] ? :out : '/dev/null'
+      spawn_opts[:out] = opts[:debug] ? :out : File::NULL
+      spawn_opts[:err] = opts[:debug] ? :out : File::NULL
 
       pid = Process.spawn(opts[:env], cmd, spawn_opts)
     end
diff --git a/spec/support/space_restricted_response_generators.rb b/spec/support/space_restricted_response_generators.rb
index b181fc09a46..bc3e1c70525 100644
--- a/spec/support/space_restricted_response_generators.rb
+++ b/spec/support/space_restricted_response_generators.rb
@@ -50,7 +50,7 @@ def self.suspended_response
   def responses_for_space_restricted_single_endpoint(response_object, permitted_roles: nil)
     permitted_roles ||= SpaceRestrictedResponseGenerators.default_permitted_roles
 
-    Hash.new(code: 404).tap do |h|
+    Hash.new({ code: 404 }.freeze).tap do |h|
       permitted_roles.each do |role|
         h[role] = { code: 200, response_object: response_object }
       end
@@ -60,7 +60,7 @@ def responses_for_space_restricted_single_endpoint(response_object, permitted_ro
   def responses_for_space_restricted_create_endpoint(success_code:, permitted_roles: nil)
     permitted_roles ||= SpaceRestrictedResponseGenerators.default_write_permitted_roles
 
-    Hash.new(code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response).tap do |h|
+    Hash.new({ code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response }.freeze).tap do |h|
       permitted_roles.each do |role|
         h[role] = { code: success_code }
       end
@@ -73,7 +73,7 @@ def responses_for_space_restricted_create_endpoint(success_code:, permitted_role
   def responses_for_space_restricted_update_endpoint(success_code:, success_body: nil)
     permitted_roles = SpaceRestrictedResponseGenerators.default_write_permitted_roles
 
-    Hash.new(code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response).tap do |h|
+    Hash.new({ code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response }.freeze).tap do |h|
       permitted_roles.each do |role|
         h[role] = { code: success_code, response_object: success_body }
       end
@@ -87,7 +87,7 @@ def responses_for_org_suspended_space_restricted_create_endpoint(success_code:,
     permitted_roles = SpaceRestrictedResponseGenerators.org_suspended_permitted_roles
     suspended_roles ||= SpaceRestrictedResponseGenerators.default_suspended_roles
 
-    Hash.new(code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response).tap do |h|
+    Hash.new({ code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response }.freeze).tap do |h|
       permitted_roles.each do |role|
         h[role] = { code: success_code }
       end
@@ -104,7 +104,7 @@ def responses_for_org_suspended_space_restricted_update_endpoint(success_code:)
     permitted_roles = SpaceRestrictedResponseGenerators.org_suspended_permitted_roles
     suspended_roles = SpaceRestrictedResponseGenerators.default_suspended_roles
 
-    Hash.new(code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response).tap do |h|
+    Hash.new({ code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response }.freeze).tap do |h|
       permitted_roles.each do |role|
         h[role] = { code: success_code }
       end
@@ -121,7 +121,7 @@ def responses_for_org_suspended_space_restricted_delete_endpoint(success_code:,
     permitted_roles = SpaceRestrictedResponseGenerators.org_suspended_permitted_roles
     suspended_roles ||= SpaceRestrictedResponseGenerators.default_suspended_roles
 
-    Hash.new(code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response).tap do |h|
+    Hash.new({ code: 403, errors: SpaceRestrictedResponseGenerators.forbidden_response }.freeze).tap do |h|
       permitted_roles.each do |role|
         h[role] = { code: success_code }
       end
@@ -137,7 +137,7 @@ def responses_for_org_suspended_space_restricted_delete_endpoint(success_code:,
   def responses_for_space_restricted_delete_endpoint(permitted_roles: nil)
     permitted_roles ||= SpaceRestrictedResponseGenerators.default_write_permitted_roles
 
-    Hash.new(code: 403).tap do |h|
+    Hash.new({ code: 403 }.freeze).tap do |h|
       permitted_roles.each do |role|
         h[role] = { code: 204 }
       end
@@ -150,7 +150,7 @@ def responses_for_space_restricted_delete_endpoint(permitted_roles: nil)
   def responses_for_space_restricted_async_delete_endpoint(permitted_roles: nil)
     permitted_roles ||= SpaceRestrictedResponseGenerators.default_write_permitted_roles
 
-    Hash.new(code: 403).tap do |h|
+    Hash.new({ code: 403 }.freeze).tap do |h|
       permitted_roles.each do |role|
         h[role] = { code: 202 }
       end
diff --git a/spec/unit/models/runtime/shared_domain_spec.rb b/spec/unit/models/runtime/shared_domain_spec.rb
index d28514402c6..6b587cfb922 100644
--- a/spec/unit/models/runtime/shared_domain_spec.rb
+++ b/spec/unit/models/runtime/shared_domain_spec.rb
@@ -250,7 +250,7 @@ module VCAP::CloudController
             before_updated_at = existing_domain.updated_at
 
             expect do
-              SharedDomain.find_or_create(**attrs.merge(internal: false))
+              SharedDomain.find_or_create(**attrs, internal: false)
             end.not_to(change(existing_domain, :reload))
             expect(fake_logger).to have_received(:warn).
               with("Domain '#{domain_name}' already exists. Skipping updates of internal status")
@@ -268,7 +268,7 @@ module VCAP::CloudController
             before_updated_at = existing_domain.updated_at
 
             expect do
-              SharedDomain.find_or_create(**attrs.merge(internal: true))
+              SharedDomain.find_or_create(**attrs, internal: true)
             end.not_to(change(existing_domain, :reload))
             expect(fake_logger).to have_received(:warn).
               with("Domain '#{domain_name}' already exists. Skipping updates of internal status")
@@ -284,7 +284,7 @@ module VCAP::CloudController
           before_updated_at = existing_domain.updated_at
 
           expect do
-            SharedDomain.find_or_create(**attrs.merge(router_group_guid: 'new rgg'))
+            SharedDomain.find_or_create(**attrs, router_group_guid: 'new rgg')
           end.not_to(change(existing_domain, :reload))
           expect(fake_logger).to have_received(:warn).
             with("Domain '#{domain_name}' already exists. Skipping updates of router_group_guid")