Requirements.txt + virtualenv, everything is fine.

Really, significantly easier to not screw up in a large org than bundler, because dependencies don't leak by default.