diff --git a/Gemfile b/Gemfile
index 91a77681..c790a535 100644
--- a/Gemfile
+++ b/Gemfile
@@ -27,7 +27,7 @@ gem "bootstrap-sass", "3.4.1"
 # Use sqlite3 as the database for Active Record
 # gem 'sqlite3'
 # Use Puma as the app server
-gem "puma", "~> 6.4"
+gem "puma", "~> 6.5"
 # Use SCSS for stylesheets
 gem "sass-rails", "~> 5.0"
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 1d4d4de6..a14b8e12 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -214,7 +214,7 @@ GEM
     newrelic_rpm (9.5.0)
     next_rails (1.3.0)
       colorize (>= 0.8.1)
-    nio4r (2.7.0)
+    nio4r (2.7.4)
     nokogiri (1.16.2-arm64-darwin)
       racc (~> 1.4)
     nokogiri (1.16.2-x86_64-darwin)
@@ -257,7 +257,7 @@ GEM
     psych (5.1.0)
       stringio
     public_suffix (5.0.3)
-    puma (6.4.2)
+    puma (6.6.0)
       nio4r (~> 2.0)
     pundit (2.3.1)
       activesupport (>= 3.0.0)
@@ -480,7 +480,7 @@ DEPENDENCIES
   next_rails
   ombu_labs-auth
   pg
-  puma (~> 6.4)
+  puma (~> 6.5)
   pundit (~> 2.2)
   rack-mini-profiler
   rails (~> 7.1.0)
diff --git a/Gemfile.next.lock b/Gemfile.next.lock
index cb36f3d1..5ce2bf8b 100644
--- a/Gemfile.next.lock
+++ b/Gemfile.next.lock
@@ -88,17 +88,17 @@ GEM
     ast (2.4.2)
     autoprefixer-rails (10.4.15.0)
       execjs (~> 2)
-    base64 (0.1.1)
-    bcrypt (3.1.19)
+    base64 (0.1.2)
+    bcrypt (3.1.20)
     benchmark (0.4.0)
-    bigdecimal (3.1.4)
+    bigdecimal (3.1.9)
     bindex (0.8.1)
     bootstrap-sass (3.4.1)
       autoprefixer-rails (>= 5.2.1)
       sassc (>= 2.0.0)
     bourbon (7.3.0)
       thor (~> 1.0)
-    builder (3.2.4)
+    builder (3.3.0)
     byebug (11.1.3)
     capybara (3.39.2)
       addressable
@@ -117,15 +117,15 @@ GEM
       execjs
     coffee-script-source (1.12.2)
     colorize (1.1.0)
-    concurrent-ruby (1.3.4)
-    connection_pool (2.4.1)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.2)
     crass (1.0.6)
-    database_cleaner-active_record (2.1.0)
+    database_cleaner-active_record (2.2.0)
       activerecord (>= 5.a)
       database_cleaner-core (~> 2.0.0)
     database_cleaner-core (2.0.1)
     date (3.4.1)
-    devise (4.8.1)
+    devise (4.9.4)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0)
@@ -137,9 +137,8 @@ GEM
     dotenv-rails (2.8.1)
       dotenv (= 2.8.1)
       railties (>= 3.2)
-    drb (2.1.1)
-      ruby2_keywords
-    erubi (1.12.0)
+    drb (2.2.1)
+    erubi (1.13.1)
     execjs (2.9.1)
     factory_bot (6.2.1)
       activesupport (>= 5.0.0)
@@ -148,19 +147,21 @@ GEM
       railties (>= 5.0.0)
     faker (3.2.1)
       i18n (>= 1.8.11, < 2)
-    faraday (2.7.11)
-      base64
-      faraday-net_http (>= 2.0, < 3.1)
-      ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.2)
+    faraday (2.13.0)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
     ffi (1.16.3)
     globalid (1.2.1)
       activesupport (>= 6.1)
     hashie (5.0.0)
-    i18n (1.14.1)
+    i18n (1.14.7)
       concurrent-ruby (~> 1.0)
-    io-console (0.6.0)
-    irb (1.14.3)
+    io-console (0.8.0)
+    irb (1.15.2)
+      pp (>= 0.6.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     jbuilder (2.11.5)
@@ -173,7 +174,8 @@ GEM
     jquery-ui-rails (6.0.1)
       railties (>= 3.2.16)
     json (2.6.3)
-    jwt (2.7.1)
+    jwt (2.10.1)
+      base64
     language_server-protocol (3.17.0.3)
     launchy (2.5.2)
       addressable (~> 2.8)
@@ -181,8 +183,8 @@ GEM
     listen (3.8.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    logger (1.6.4)
-    loofah (2.21.3)
+    logger (1.7.0)
+    loofah (2.24.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     madmin (1.2.8)
@@ -199,26 +201,29 @@ GEM
       nokogiri (~> 1)
       rake
     mini_mime (1.1.5)
-    mini_portile2 (2.8.4)
-    minitest (5.20.0)
-    multi_xml (0.6.0)
-    net-imap (0.5.5)
+    mini_portile2 (2.8.8)
+    minitest (5.25.5)
+    multi_xml (0.7.1)
+      bigdecimal (~> 3.1)
+    net-http (0.6.0)
+      uri
+    net-imap (0.5.7)
       date
       net-protocol
     net-pop (0.1.2)
       net-protocol
     net-protocol (0.2.2)
       timeout
-    net-smtp (0.5.0)
+    net-smtp (0.5.1)
       net-protocol
     newrelic_rpm (9.5.0)
     next_rails (1.3.0)
       colorize (>= 0.8.1)
-    nio4r (2.5.9)
-    nokogiri (1.15.4)
+    nio4r (2.7.4)
+    nokogiri (1.18.8)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.15.4-x86_64-linux)
+    nokogiri (1.18.8-x86_64-linux-gnu)
       racc (~> 1.4)
     oauth2 (2.0.9)
       faraday (>= 0.17.3, < 3.0)
@@ -227,13 +232,13 @@ GEM
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0)
       version_gem (~> 1.1)
-    ombu_labs-auth (1.0.0)
-      devise (~> 4.8.1)
+    ombu_labs-auth (1.1.0)
+      devise (~> 4.9)
       omniauth (~> 2.1.0)
       omniauth-github (~> 2.0.0)
       omniauth-rails_csrf_protection
-      rails (>= 6.0)
-    omniauth (2.1.1)
+      rails (>= 6.0, < 8.1)
+    omniauth (2.1.3)
       hashie (>= 3.4.6)
       rack (>= 2.2.3)
       rack-protection
@@ -243,7 +248,7 @@ GEM
     omniauth-oauth2 (1.8.0)
       oauth2 (>= 1.4, < 3)
       omniauth (~> 2.0)
-    omniauth-rails_csrf_protection (1.0.1)
+    omniauth-rails_csrf_protection (1.0.2)
       actionpack (>= 4.2)
       omniauth (~> 2.0)
     orm_adapter (0.5.0)
@@ -253,24 +258,29 @@ GEM
       ast (~> 2.4.1)
       racc
     pg (1.5.4)
-    psych (5.1.0)
+    pp (0.6.2)
+      prettyprint
+    prettyprint (0.2.0)
+    psych (5.2.3)
+      date
       stringio
     public_suffix (5.0.3)
-    puma (6.4.0)
+    puma (6.6.0)
       nio4r (~> 2.0)
     pundit (2.3.1)
       activesupport (>= 3.0.0)
-    racc (1.7.1)
-    rack (2.2.8)
+    racc (1.8.1)
+    rack (2.2.13)
     rack-mini-profiler (3.1.1)
       rack (>= 1.2.0)
-    rack-protection (3.1.0)
+    rack-protection (3.2.0)
+      base64 (>= 0.1.0)
       rack (~> 2.2, >= 2.2.4)
-    rack-session (1.0.1)
+    rack-session (1.0.2)
       rack (< 3)
-    rack-test (2.1.0)
+    rack-test (2.2.0)
       rack (>= 1.3)
-    rackup (1.0.0)
+    rackup (1.0.1)
       rack (< 3)
       webrick
     rails (7.2.2.1)
@@ -295,9 +305,9 @@ GEM
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.0)
+    rails-html-sanitizer (1.6.2)
       loofah (~> 2.21)
-      nokogiri (~> 1.14)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     railties (7.2.2.1)
       actionpack (= 7.2.2.1)
       activesupport (= 7.2.2.1)
@@ -307,18 +317,18 @@ GEM
       thor (~> 1.0, >= 1.2.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.0.6)
+    rake (13.2.1)
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rdoc (6.5.0)
+    rdoc (6.13.1)
       psych (>= 4.0.0)
     recursive-open-struct (1.1.3)
     redcarpet (3.5.1)
     regexp_parser (2.8.1)
-    reline (0.6.0)
+    reline (0.6.1)
       io-console (~> 0.5)
-    responders (3.1.0)
+    responders (3.1.1)
       actionpack (>= 5.2)
       railties (>= 5.2)
     rexml (3.2.6)
@@ -357,7 +367,6 @@ GEM
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
     ruby-progressbar (1.13.0)
-    ruby2_keywords (0.0.5)
     rubyzip (2.3.2)
     sass (3.7.4)
       sass-listen (~> 4.0.0)
@@ -417,20 +426,21 @@ GEM
       rubocop-performance (~> 1.19.0)
     standardrb (1.0.1)
       standard
-    stringio (3.0.8)
+    stringio (3.1.7)
     terser (1.1.18)
       execjs (>= 0.3.0, < 3)
-    thor (1.2.2)
+    thor (1.3.2)
     tilt (2.3.0)
-    timeout (0.4.0)
+    timeout (0.4.3)
     turbolinks (5.2.1)
       turbolinks-source (~> 5.2)
     turbolinks-source (5.2.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.5.0)
+    uri (1.0.3)
     useragent (0.16.11)
-    version_gem (1.1.3)
+    version_gem (1.1.7)
     warden (1.2.9)
       rack (>= 2.0.9)
     web-console (4.2.1)
@@ -442,14 +452,15 @@ GEM
       nokogiri (~> 1.6)
       rubyzip (>= 1.3.0)
       selenium-webdriver (~> 4.0, < 4.11)
-    webrick (1.8.1)
+    webrick (1.9.1)
     websocket (1.2.10)
-    websocket-driver (0.7.6)
+    websocket-driver (0.7.7)
+      base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.6.12)
+    zeitwerk (2.7.2)
 
 PLATFORMS
   ruby
@@ -479,7 +490,7 @@ DEPENDENCIES
   next_rails
   ombu_labs-auth
   pg
-  puma (~> 6.4)
+  puma (~> 6.5)
   pundit (~> 2.2)
   rack-mini-profiler
   rails (~> 7.2.0)
diff --git a/app/models/project.rb b/app/models/project.rb
index da08e80c..48f445df 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -74,7 +74,10 @@ def siblings
   end
 
   def clone_stories_into(clone)
-    stories.each { |story| clone.stories.create(story.dup.attributes) }
+    stories.each do |story|
+      attrs = story.dup.attributes.slice("title", "description", "position", "extra_info")
+      clone.stories.create(attrs)
+    end
   end
 
   def clone_projects_into(clone, only: nil)
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 0eaa536f..8b51418f 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -133,6 +133,21 @@
     end
   end
 
+  describe "#cloning behaviour" do
+    it "clones stories into the new project but does not copy status" do
+      original_project = FactoryBot.create(:project)
+      FactoryBot.create(:story, :approved, project: original_project, position: 2)
+      FactoryBot.create(:story, :rejected, project: original_project, position: 1)
+      FactoryBot.create(:story, :pending, project: original_project, position: 3)
+
+      new_project = FactoryBot.create(:project)
+      original_project.clone_stories_into(new_project)
+      new_project.stories.each do |story|
+        expect(story).to be_pending
+      end
+    end
+  end
+
   def add_sub_project
     FactoryBot.create(:project, parent: subject, status: subject.status)
   end