diff --git a/.rubocop.yml b/.rubocop.yml
index f8867b323..89d817272 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -379,9 +379,9 @@ Style/ClassAndModuleChildren:
   Enabled: true
   SafeAutoCorrect: true
 
-# Style/OptionHash:
-#   Description: "Don't use option hashes when you can use keyword arguments."
-#   Enabled: false
+Style/OptionHash:
+  Description: "Don't use option hashes when you can use keyword arguments."
+  Enabled: true
 
 Style/Next:
   Description: 'Use `next` to skip iteration instead of a condition at the end.'
diff --git a/app/controllers/concerns/fastly_headers.rb b/app/controllers/concerns/fastly_headers.rb
index e3bcb3b89..1100f1e3a 100644
--- a/app/controllers/concerns/fastly_headers.rb
+++ b/app/controllers/concerns/fastly_headers.rb
@@ -8,13 +8,20 @@ module FastlyHeaders
   # Surrogate-Control is stripped at the cache, Cache-Control persists (in case of other caches in front of fastly)
   # Defaults are:
   #  Cache-Control: 'public, no-cache'
-  #  Surrogate-Control: 'max-age: 86400' - 30 days in seconds
+  #  Surrogate-Control: 'max-age: 86400' - 1 day in seconds
   # custom config example:
   #  {cache_control: 'public, no-cache, maxage=xyz', surrogate_control: 'max-age: 100'}
-  def set_cache_control_headers(max_age = 1.day.to_i, opts = {})
+  def set_cache_control_headers(
+    max_age = 1.day.to_i, cache_control: "public, no-cache",
+    surrogate_control: nil, stale_while_revalidate: nil, stale_if_error: 26_400
+  )
     request.session_options[:skip] = true # no cookies
-    response.headers["Cache-Control"] = opts[:cache_control] || "public, no-cache"
-    response.headers["Surrogate-Control"] = opts[:surrogate_control] || build_surrogate_control(max_age, opts)
+
+    response.headers["Cache-Control"] = cache_control
+
+    response.headers["Surrogate-Control"] = surrogate_control.presence || build_surrogate_control(
+      max_age, stale_while_revalidate: stale_while_revalidate, stale_if_error: stale_if_error
+    )
   end
 
   # Sets Surrogate-Key HTTP header with one or more keys strips session data
@@ -26,10 +33,8 @@ module FastlyHeaders
 
   private
 
-  def build_surrogate_control(max_age, opts)
+  def build_surrogate_control(max_age, stale_while_revalidate: nil, stale_if_error: 26_400)
     surrogate_control = "max-age=#{max_age}"
-    stale_while_revalidate = opts[:stale_while_revalidate]
-    stale_if_error = opts[:stale_if_error] || 26_400
 
     surrogate_control += ", stale-while-revalidate=#{stale_while_revalidate}" if stale_while_revalidate
     surrogate_control += ", stale-if-error=#{stale_if_error}" if stale_if_error
diff --git a/app/services/authentication/paths.rb b/app/services/authentication/paths.rb
index 223141753..57166a6a2 100644
--- a/app/services/authentication/paths.rb
+++ b/app/services/authentication/paths.rb
@@ -1,3 +1,4 @@
+# rubocop:disable Style/OptionHash
 module Authentication
   # These are meant to be called from the specific providers
   module Paths
@@ -21,3 +22,4 @@ module Authentication
     end
   end
 end
+# rubocop:enable Style/OptionHash
diff --git a/app/services/authentication/providers/github.rb b/app/services/authentication/providers/github.rb
index fa1f58c81..8bfaae6ed 100644
--- a/app/services/authentication/providers/github.rb
+++ b/app/services/authentication/providers/github.rb
@@ -42,12 +42,14 @@ module Authentication
         SETTINGS_URL
       end
 
+      # rubocop:disable Style/OptionHash
       def self.sign_in_path(params = {})
         ::Authentication::Paths.sign_in_path(
           provider_name,
           params,
         )
       end
+      # rubocop:enable Style/OptionHash
 
       protected
 
diff --git a/app/services/authentication/providers/provider.rb b/app/services/authentication/providers/provider.rb
index a2ac6d645..8a78bb212 100644
--- a/app/services/authentication/providers/provider.rb
+++ b/app/services/authentication/providers/provider.rb
@@ -49,9 +49,11 @@ module Authentication
         raise SubclassResponsibility
       end
 
+      # rubocop:disable Style/OptionHash
       def self.authentication_path(params = {})
         ::Authentication::Paths.authentication_path(provider_name, params)
       end
+      # rubocop:enable Style/OptionHash
 
       def self.sign_in_path(_params = {})
         raise SubclassResponsibility
diff --git a/app/services/authentication/providers/twitter.rb b/app/services/authentication/providers/twitter.rb
index 11a1d6e2a..3dd6d408e 100644
--- a/app/services/authentication/providers/twitter.rb
+++ b/app/services/authentication/providers/twitter.rb
@@ -47,6 +47,7 @@ module Authentication
         SETTINGS_URL
       end
 
+      # rubocop:disable Style/OptionHash
       def self.sign_in_path(params = {})
         # see https://github.com/arunagw/omniauth-twitter#authentication-options
         mandatory_params = { secure_image_url: true }
@@ -56,6 +57,7 @@ module Authentication
           params.merge(mandatory_params),
         )
       end
+      # rubocop:enable Style/OptionHash
 
       protected
 
diff --git a/config/initializers/slack_notifier.rb b/config/initializers/slack_notifier.rb
index 44983dece..d9932c4dd 100644
--- a/config/initializers/slack_notifier.rb
+++ b/config/initializers/slack_notifier.rb
@@ -1,7 +1,9 @@
 class NoOpHTTPClient
+  # rubocop:disable Style/OptionHash
   def self.post(uri, params = {})
     # bonus, you could log or observe posted params here
   end
+  # rubocop:enable Style/OptionHash
 end
 
 def create_normal_notifier
diff --git a/spec/requests/comments_create_spec.rb b/spec/requests/comments_create_spec.rb
index 544956d91..4eb7fc52f 100644
--- a/spec/requests/comments_create_spec.rb
+++ b/spec/requests/comments_create_spec.rb
@@ -11,6 +11,7 @@ RSpec.describe "CommentsCreate", type: :request do
     sign_in user
   end
 
+  # rubocop:disable Style/OptionHash
   def comment_params(params = {})
     {
       comment: {
@@ -20,6 +21,7 @@ RSpec.describe "CommentsCreate", type: :request do
       }.merge(params)
     }
   end
+  # rubocop:enable Style/OptionHash
 
   it "creates a comment with proper params" do
     expect do
diff --git a/spec/support/initializers/warden.rb b/spec/support/initializers/warden.rb
index 2feb202a2..eb6a82b55 100644
--- a/spec/support/initializers/warden.rb
+++ b/spec/support/initializers/warden.rb
@@ -1,6 +1,7 @@
 module Warden
   module Test
     module Helpers
+      # rubocop:disable Style/OptionHash
       # Override Warden Test Helper login and logout methods with on_request
       # instead of on_next_request in order to prevent the race condition where
       # we make a request before the user is finished authenticating
@@ -11,6 +12,7 @@ module Warden
           proxy.set_user(user, opts)
         end
       end
+      # rubocop:enable Style/OptionHash
 
       def logout(*scopes)
         Warden::Manager.on_request do |proxy|