diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cdb4aa69..0af19b7e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,7 +7,7 @@ jobs:
     name: build (${{ matrix.ruby }} / ${{ matrix.os }})
     strategy:
       matrix:
-        ruby: [ '3.0', 2.7, 2.6, head ]
+        ruby: [ '3.0', 2.7, 2.6, 2.5, head ]
         os: [ ubuntu-latest, macos-latest ]
     runs-on: ${{ matrix.os }}
     steps:
@@ -21,4 +21,4 @@ jobs:
         gem install bundler --no-document
         bundle install
     - name: Run test
-      run: rake test
+      run: bundle exec rake test
diff --git a/Gemfile.lock b/Gemfile.lock
index 67321d2a..9e421eee 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -12,9 +12,9 @@ GEM
     net-protocol (0.1.0)
       io-wait
       timeout
-    power_assert (1.1.5)
+    power_assert (2.0.0)
     rake (13.0.1)
-    test-unit (3.3.5)
+    test-unit (3.4.0)
       power_assert
     timeout (0.1.1)
     uri (0.10.1)
@@ -30,4 +30,4 @@ DEPENDENCIES
   webrick
 
 BUNDLED WITH
-   2.1.4
+   2.2.15
diff --git a/net-http.gemspec b/net-http.gemspec
index f5ef4045..ae78b43c 100644
--- a/net-http.gemspec
+++ b/net-http.gemspec
@@ -16,7 +16,7 @@ Gem::Specification.new do |spec|
   spec.summary       = %q{HTTP client api for Ruby.}
   spec.description   = %q{HTTP client api for Ruby.}
   spec.homepage      = "https://github.com/ruby/net-http"
-  spec.required_ruby_version = Gem::Requirement.new(">= 2.6.0")
+  spec.required_ruby_version = Gem::Requirement.new(">= 2.5.0")
   spec.licenses      = ["Ruby", "BSD-2-Clause"]
 
   spec.metadata["homepage_uri"] = spec.homepage
diff --git a/test/net/http/test_https.rb b/test/net/http/test_https.rb
index e9aee15b..7c9c0480 100644
--- a/test/net/http/test_https.rb
+++ b/test/net/http/test_https.rb
@@ -45,7 +45,7 @@ def test_get
       assert_equal($test_net_http_data, res.body)
     }
     # TODO: OpenSSL 1.1.1h seems to yield only SERVER_CERT; need to check the incompatibility
-    certs.zip([CA_CERT, SERVER_CERT][-certs.size..]) do |actual, expected|
+    certs.zip([CA_CERT, SERVER_CERT][-certs.size..-1]) do |actual, expected|
       assert_equal(expected.to_der, actual.to_der)
     end
   rescue SystemCallError
@@ -66,7 +66,7 @@ def test_get_SNI
       assert_equal($test_net_http_data, res.body)
     }
     # TODO: OpenSSL 1.1.1h seems to yield only SERVER_CERT; need to check the incompatibility
-    certs.zip([CA_CERT, SERVER_CERT][-certs.size..]) do |actual, expected|
+    certs.zip([CA_CERT, SERVER_CERT][-certs.size..-1]) do |actual, expected|
       assert_equal(expected.to_der, actual.to_der)
     end
   end