diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 705e1aa..3b17f44 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -2,4 +2,4 @@
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
 # No matter which file got changed, request a review from the main developers
- * @openvoxproject/container-maintainers
+ * @OpenVoxProject/container-maintainers
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 49b971a..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-# Managed by modulesync - DO NOT EDIT
-# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
-
-version: 2
-updates:
-  # raise PRs for gem updates
-  - package-ecosystem: bundler
-    directory: "/"
-    schedule:
-      interval: daily
-      time: "13:00"
-    open-pull-requests-limit: 10
-
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: daily
-      time: "13:00"
-    open-pull-requests-limit: 10
-
-  - package-ecosystem: "docker"
-    directory: "/"
-    schedule:
-      interval: "daily"
-      time: "13:00"
-    open-pull-requests-limit: 10
diff --git a/.github/renovate.jsonc b/.github/renovate.jsonc
new file mode 100644
index 0000000..286c8ac
--- /dev/null
+++ b/.github/renovate.jsonc
@@ -0,0 +1,68 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  // Apply shared labels so dependency updates are easy to filter in GitHub.
+  "addLabels": [
+    "dependencies",
+    "renovate"
+  ],
+  // Keep routine dependency updates low-touch for repos with CODEOWNERS.
+  "assigneesFromCodeOwners": true,
+  "customManagers": [
+    {
+      // Track Ruby gem versions declared in build_versions.yaml.
+      "customType": "regex",
+      "datasourceTemplate": "rubygems",
+      "managerFilePatterns": [
+        "/build_versions.yaml/"
+      ],
+      "matchStrings": [
+        "rubygem_(?<depName>[a-z0-9_-]+):\\s+'(?<currentValue>\\d+\\.\\d+\\.\\d+)'"
+      ]
+    },
+    {
+      // Track gem versions set as RUBYGEM_* defaults in Containerfiles.
+      "customType": "regex",
+      "datasourceTemplate": "rubygems",
+      "versioningTemplate": "ruby",
+      "managerFilePatterns": [
+        "/Containerfile/"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*depName=(?<depName>[a-zA-Z0-9_-]+)\\s+datasource=rubygems\\s*\\n\\s*ENV\\s+RUBYGEM_[A-Z0-9_-]+=\\$\\{RUBYGEM_[A-Z0-9_-]+:-?(?<currentValue>[^}\\n]+)\\}"
+      ]
+    },
+    {
+      // Track OpenVox gem versions in matrix definitions.
+      "customType": "regex",
+      "datasourceTemplate": "rubygems",
+      "versioningTemplate": "ruby",
+      "managerFilePatterns": [
+        "/build_platforms.yaml/"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*depName=(?<depName>[a-zA-Z0-9_-]+)\\s+datasource=rubygems\\s*\\n\\s*(?<key>openvox_version):\\s*'(?<currentValue>[^']+)'"
+      ]
+    }
+  ],
+  // Use Renovate's normal defaults, but open PRs immediately instead of waiting.
+  "extends": [
+    "config:recommended",
+    ":prImmediately"
+  ],
+  // Mark vulnerability alerts separately from normal dependency updates.
+  "vulnerabilityAlerts": {
+    "addLabels": [
+      "security"
+    ],
+    "enabled": true
+  },
+  "packageRules": [
+    {
+      // Do not require dashboard approval before creating updates.
+      "dependencyDashboardApproval": false,
+      "matchPackageNames": [
+        "/.*/"
+      ]
+    }
+  ]
+}
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
new file mode 100644
index 0000000..ed56357
--- /dev/null
+++ b/.github/workflows/automerge.yml
@@ -0,0 +1,28 @@
+---
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
+
+name: 🤖 Enable Auto-Merge
+
+# yamllint disable-line rule:truthy
+on:
+  pull_request: {}
+
+permissions:
+  contents: read
+
+jobs:
+  automerge:
+    name: Enable auto-merge
+    if: github.event_name == 'pull_request' && (github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'renovate[bot]')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Enable auto-merge for PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: gh pr merge --auto --merge --match-head-commit "$PR_HEAD_SHA" "$PR_URL"
diff --git a/.github/workflows/build_container.yml b/.github/workflows/build_container.yml
index cb9b84b..2b26c5b 100644
--- a/.github/workflows/build_container.yml
+++ b/.github/workflows/build_container.yml
@@ -1,10 +1,14 @@
 ---
-name: Build and publish a 🛢️ container
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
+name: 📦 Build and Publish
+
+# yamllint disable-line rule:truthy
 on:
   push:
     branches:
-      - 'main'
+      - main
     tags:
       - 'v*'
   workflow_dispatch:
@@ -14,41 +18,52 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  contents: read # minimal required permissions to clone repo
+  contents: read
 
 jobs:
   setup-matrix:
+    name: Set up build matrix
     runs-on: ubuntu-latest
     outputs:
-      build_matrix: ${{ steps.set-build-matrix.outputs.build_matrix }}
-      tag_matrix: ${{ steps.set-tag-matrix.outputs.tag_matrix }}
+      build-matrix: ${{ steps.build-matrix.outputs.build-matrix }}
+      manifest-matrix: ${{ steps.manifest-matrix.outputs.manifest-matrix }}
     steps:
-      - name: Source checkout
-        uses: actions/checkout@v7
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: 'Setup yq'
-        uses: dcarbone/install-yq-action@v1.3.1
+      - name: Install yq
+        uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
 
-      - id: set-build-matrix
-        run: echo "build_matrix=$(bash matrix.sh build)" >> $GITHUB_OUTPUT
+      - name: Generate build matrix
+        id: build-matrix
+        run: |
+          matrix_json=$(bash matrix.sh build)
+          echo "build-matrix=$matrix_json" >> "$GITHUB_OUTPUT"
 
-      - id: set-tag-matrix
-        run: echo "tag_matrix=$(bash matrix.sh tag)" >> $GITHUB_OUTPUT
+      - name: Generate manifest matrix
+        id: manifest-matrix
+        run: |
+          matrix_json=$(bash matrix.sh tag)
+          echo "manifest-matrix=$matrix_json" >> "$GITHUB_OUTPUT"
 
   build-and-push-container:
+    name: Build OpenVox Server ${{ matrix.server_version }} (${{ matrix.os }}/${{ matrix.platform }})
     runs-on: ${{ matrix.runner }}
+    needs:
+      - setup-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.build-matrix) }}
     permissions:
       contents: read
       packages: write
-    needs: setup-matrix
-    strategy:
-      matrix: ${{ fromJson(needs.setup-matrix.outputs.build_matrix) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Build ${{ matrix.os }} / ${{ matrix.platform }} container
-        uses: voxpupuli/gha-build-and-publish-a-container@v2
+      - name: Build and publish container
+        id: build
+        uses: voxpupuli/gha-build-and-publish-a-container@f1680271a3fd34267c1401c760a15f45a9cf34ca # v2.0.0
         with:
           registry_password: ${{ secrets.GITHUB_TOKEN }}
           build_args: |
@@ -61,92 +76,65 @@ jobs:
           build_arch: linux/${{ matrix.platform }}
           build_context: .
           buildfile: Containerfile.${{ matrix.os }}
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8-<sha>-ubuntu-amd64
-          tags: ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-${{ matrix.os }}-${{ matrix.platform }}
+          tags: |
+            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-${{ matrix.os }}-${{ matrix.platform }}
 
-  create-multi-arch-manifests:
+  create-multiarch-manifests:
+    name: Create multi-architecture manifests
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     needs:
       - setup-matrix
       - build-and-push-container
     strategy:
-      matrix: ${{ fromJson(needs.setup-matrix.outputs.tag_matrix) }}
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.manifest-matrix) }}
+    permissions:
+      contents: read
+      packages: write
     steps:
-      - name: Log in to the ghcr.io registry
-        uses: docker/login-action@v4
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Log in to the docker.io registry
-        uses: docker/login-action@v4
+      - name: Log in to Docker Hub
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: docker.io
           username: voxpupulibot
           password: ${{ secrets.DOCKERHUB_BOT_ADMIN_TOKEN }}
 
-      - name: Create ref-specific multi-arch manifests
+      - name: Create ref-specific Ubuntu manifest
+        run: |
+          docker buildx imagetools create -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.server_version }}-${{ github.ref_name }} -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.server_version }} -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }} -t docker.io/voxpupuli/openvoxserver:${{ matrix.server_version }}-${{ github.ref_name }} -t docker.io/voxpupuli/openvoxserver:${{ matrix.server_version }} -t docker.io/voxpupuli/openvoxserver:${{ matrix.release }} ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-ubuntu-arm64 ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-ubuntu-amd64
+
+      - name: Create ref-specific Alpine manifest
         run: |
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8.13.0-v1.2.3
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8.13.0-main
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8.13.0
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8
-          docker buildx imagetools create \
-            -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.server_version }}-${{ github.ref_name }} \
-            -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.server_version }} \
-            -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }} \
-            -t docker.io/voxpupuli/openvoxserver:${{ matrix.server_version }}-${{ github.ref_name }} \
-            -t docker.io/voxpupuli/openvoxserver:${{ matrix.server_version }} \
-            -t docker.io/voxpupuli/openvoxserver:${{ matrix.release }} \
-            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-ubuntu-arm64 \
-            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-ubuntu-amd64
-
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8.13.0-v1.2.3-alpine
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8.13.0-main-alpine
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8.13.0-alpine
-          # tag will look like: ghcr.io/openvoxproject/openvoxserver:8-alpine
-          docker buildx imagetools create \
-            -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.server_version }}-${{ github.ref_name }}-alpine \
-            -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.server_version }}-alpine \
-            -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-alpine \
-            -t docker.io/voxpupuli/openvoxserver:${{ matrix.server_version }}-${{ github.ref_name }}-alpine \
-            -t docker.io/voxpupuli/openvoxserver:${{ matrix.server_version }}-alpine \
-            -t docker.io/voxpupuli/openvoxserver:${{ matrix.release }}-alpine \
-            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-alpine-arm64 \
-            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-alpine-amd64
-
-      - name: Update floating multi-arch tags
+          docker buildx imagetools create -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.server_version }}-${{ github.ref_name }}-alpine -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.server_version }}-alpine -t ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-alpine -t docker.io/voxpupuli/openvoxserver:${{ matrix.server_version }}-${{ github.ref_name }}-alpine -t docker.io/voxpupuli/openvoxserver:${{ matrix.server_version }}-alpine -t docker.io/voxpupuli/openvoxserver:${{ matrix.release }}-alpine ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-alpine-arm64 ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-alpine-amd64
+
+      - name: Update floating Ubuntu tag
         if: github.ref == 'refs/heads/main'
         run: |
-          # Ubuntu is the default variant and therefore has no OS suffix.
-          docker buildx imagetools create \
-            -t ghcr.io/openvoxproject/openvoxserver:latest \
-            -t docker.io/voxpupuli/openvoxserver:latest \
-            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-ubuntu-arm64 \
-            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-ubuntu-amd64
-
-          docker buildx imagetools create \
-            -t ghcr.io/openvoxproject/openvoxserver:latest-alpine \
-            -t docker.io/voxpupuli/openvoxserver:latest-alpine \
-            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-alpine-arm64 \
-            ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-alpine-amd64
+          docker buildx imagetools create -t ghcr.io/openvoxproject/openvoxserver:latest -t docker.io/voxpupuli/openvoxserver:latest ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-ubuntu-arm64 ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-ubuntu-amd64
+
+      - name: Update floating Alpine tag
+        if: github.ref == 'refs/heads/main'
+        run: |
+          docker buildx imagetools create -t ghcr.io/openvoxproject/openvoxserver:latest-alpine -t docker.io/voxpupuli/openvoxserver:latest-alpine ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-alpine-arm64 ghcr.io/openvoxproject/openvoxserver:${{ matrix.release }}-${{ github.sha }}-alpine-amd64
 
   update-dockerhub-description:
+    name: Update Docker Hub description
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     needs:
-      - create-multi-arch-manifests
+      - create-multiarch-manifests
     steps:
-      - name: Source checkout
-        uses: actions/checkout@v7
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Update Docker Hub Description
-        uses: peter-evans/dockerhub-description@v5
+      - name: Update Docker Hub description
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
         with:
           username: voxpupulibot
           password: ${{ secrets.DOCKERHUB_BOT_ADMIN_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 57d83fc..161e05f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,51 +1,64 @@
 ---
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
+
 name: 🚦 CI
 
+# yamllint disable-line rule:truthy
 on:
   pull_request:
     branches:
-      - 'main'
+      - main
   workflow_dispatch:
+  merge_group:
+    branches:
+      - main
 
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:
-  contents: read # minimal required permissions to clone repo
+  contents: read
 
 jobs:
   setup-matrix:
+    name: Set up build matrix
     runs-on: ubuntu-latest
     outputs:
-      build_matrix: ${{ steps.set-build-matrix.outputs.build_matrix }}
+      build-matrix: ${{ steps.build-matrix.outputs.build-matrix }}
     steps:
-      - name: Source checkout
-        uses: actions/checkout@v7
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: 'Setup yq'
-        uses: dcarbone/install-yq-action@v1.3.1
+      - name: Install yq
+        uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
 
-      - id: set-build-matrix
-        run: echo "build_matrix=$(bash matrix.sh build)" >> $GITHUB_OUTPUT
+      - name: Generate build matrix
+        id: build-matrix
+        run: echo "build-matrix=$(bash matrix.sh build)" >> "$GITHUB_OUTPUT"
 
-  build_ci_container:
+  build-container:
     name: Build ${{ matrix.os }} / ${{ matrix.platform }} CI container
     runs-on: ${{ matrix.runner }}
-    needs: setup-matrix
+    needs:
+      - setup-matrix
     strategy:
       fail-fast: false
-      matrix: ${{ fromJson(needs.setup-matrix.outputs.build_matrix) }}
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.build-matrix) }}
+    permissions:
+      actions: read
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Build ${{ matrix.os }} / ${{ matrix.platform }} CI container
-        uses: docker/build-push-action@v7
+      - name: Build image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          tags: ci/openvoxserver:${{ matrix.server_version }}-${{ matrix.os }}-${{ matrix.platform }}
           context: .
           file: Containerfile.${{ matrix.os }}
+          tags: 'ci/openvoxserver:${{ matrix.server_version }}-${{ matrix.os }}-${{ matrix.platform }}'
           push: false
           platforms: linux/${{ matrix.platform }}
           build-args: |
@@ -55,41 +68,16 @@ jobs:
             RUBYGEM_R10K=${{ matrix.rubygem_r10k }}
             RUBYGEM_RUGGED=${{ matrix.rubygem_rugged }}
             JDK_VERSION=${{ matrix.jdk_version }}
-      - name: Test catalog
-        run: |
-          docker run --rm -v "$PWD/tests:/tests:ro,Z" --entrypoint puppet \
-            ci/openvoxserver:${{ matrix.server_version }}-${{ matrix.os }}-${{ matrix.platform }} \
-            catalog compile --manifest /tests/simple_catalog.pp --render-as json > catalog.json
-          grep -q '"type":"Host"' catalog.json
-          grep -q '"type":"Cron"' catalog.json
 
   tests:
-    needs:
-      - setup-matrix
-      - build_ci_container
-    runs-on: ubuntu-latest
     name: Test suite
-    steps:
-      - run: echo Test suite completed
-
-  dependabot:
-    permissions:
-      contents: write
-      pull-requests: write
-    name: 'Dependabot auto-merge'
+    if: always()
     needs:
-      - tests
-    runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'
+      - setup-matrix
+      - build-container
+    runs-on: ubuntu-24.04
     steps:
-      - name: Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v3.1.0
+      - name: Verify required jobs
+        uses: re-actors/alls-green@release/v1
         with:
-          github-token: '${{ secrets.GITHUB_TOKEN }}'
-
-      - name: Enable auto-merge for Dependabot PRs
-        run: gh pr merge --auto --merge "$PR_URL"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index f63d9c8..6fa65ec 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -14,8 +14,8 @@ jobs:
   labeler:
     name: Labeler
     runs-on: ubuntu-latest
-    if: github.repository_owner == 'voxpupuli'
+    if: github.repository_owner == 'voxpupuli' || github.repository_owner == 'OpenVoxProject'
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml
index 81e4438..6011d28 100644
--- a/.github/workflows/markdownlint.yml
+++ b/.github/workflows/markdownlint.yml
@@ -17,7 +17,7 @@ jobs:
   markdown-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: DavidAnson/markdownlint-cli2-action@v23
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: DavidAnson/markdownlint-cli2-action@6bf21b07787794f89a243495939cd651942aeabe # v24.1.0
         with:
           globs: '**/*.md'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fdce03a..8790f16 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,7 @@ on:
   push:
     tags:
       - '*'
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/security_scanning.yml b/.github/workflows/security_scanning.yml
index 3ef68c6..0589cee 100644
--- a/.github/workflows/security_scanning.yml
+++ b/.github/workflows/security_scanning.yml
@@ -1,6 +1,10 @@
 ---
-name: Security Scanning 🕵️
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
+name: 🕵️ Security Scanning
+
+# yamllint disable-line rule:truthy
 on:
   push:
     branches:
@@ -8,50 +12,54 @@ on:
   pull_request:
     branches:
       - main
+  workflow_dispatch:
 
 concurrency:
   group: security-scanning-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:
-  contents: read # minimal required permissions to clone repo
+  contents: read
 
 jobs:
   setup-matrix:
+    name: Set up build matrix
     runs-on: ubuntu-latest
     outputs:
-      build_matrix: ${{ steps.set-build-matrix.outputs.build_matrix }}
+      build-matrix: ${{ steps.build-matrix.outputs.build-matrix }}
     steps:
-      - name: Source checkout
-        uses: actions/checkout@v7
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: 'Setup yq'
-        uses: dcarbone/install-yq-action@v1.3.1
+      - name: Install yq
+        uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
 
-      - id: set-build-matrix
-        run: echo "build_matrix=$(bash matrix.sh build)" >> $GITHUB_OUTPUT
+      - name: Generate build matrix
+        id: build-matrix
+        run: echo "build-matrix=$(bash matrix.sh build)" >> "$GITHUB_OUTPUT"
 
-  scan_ci_container:
-    name: 'Scan ${{ matrix.os }} / ${{ matrix.platform }} CI container'
+  scan-container:
+    name: Scan ${{ matrix.os }} / ${{ matrix.platform }} container
     runs-on: ${{ matrix.runner }}
+    needs:
+      - setup-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.build-matrix) }}
     permissions:
       actions: read
       contents: read
       security-events: write
-    needs: setup-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.setup-matrix.outputs.build_matrix) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Build ${{ matrix.os }} / ${{ matrix.platform }} CI container
-        uses: docker/build-push-action@v7
+      - name: Build image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          tags: ci/openvoxserver:${{ matrix.server_version }}-${{ matrix.os }}-${{ matrix.platform }}
           context: .
           file: Containerfile.${{ matrix.os }}
+          tags: 'ci/openvoxserver:${{ matrix.server_version }}-${{ matrix.os }}-${{ matrix.platform }}'
           load: true
           push: false
           platforms: linux/${{ matrix.platform }}
@@ -64,17 +72,17 @@ jobs:
             JDK_VERSION=${{ matrix.jdk_version }}
 
       - name: Scan image with Anchore Grype
-        uses: anchore/scan-action@v7
         id: scan
+        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
         with:
           image: 'ci/openvoxserver:${{ matrix.server_version }}-${{ matrix.os }}-${{ matrix.platform }}'
           fail-build: false
 
-      - name: Inspect action SARIF report
-        run: jq . ${{ steps.scan.outputs.sarif }}
+      - name: Inspect SARIF report
+        run: jq . "${{ steps.scan.outputs.sarif }}"
 
-      - name: Upload Anchore scan SARIF report
-        uses: github/codeql-action/upload-sarif@v4
+      - name: Upload SARIF report
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
-          category: grype-${{ matrix.os }}-${{ matrix.platform }}
+          category: 'grype-${{ matrix.os }}-${{ matrix.platform }}'
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index c86970d..fe3d1ab 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -22,20 +22,20 @@ jobs:
       actions: read
     steps:
     - name: Repository checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         # Differential ShellCheck requires full git history
         fetch-depth: 0
 
     - id: ShellCheck
       name: Differential ShellCheck
-      uses: redhat-plumbers-in-action/differential-shellcheck@v5
+      uses: redhat-plumbers-in-action/differential-shellcheck@d965e66ec0b3b2f821f75c8eff9b12442d9a7d1e # v5.5.6
       with:
         scan-directory: '.'
 
     - if: always()
       name: Upload artifact with ShellCheck defects in SARIF format
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: Differential ShellCheck SARIF
         path: ${{ steps.ShellCheck.outputs.sarif }}
diff --git a/.gitignore b/.gitignore
index 8cf65be..fa398bc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@
 .vendor/
 vendor/
 Gemfile.lock
+.DS_Store
diff --git a/.markdownlint.yaml b/.markdownlint.yaml
index 2747978..844c0bc 100644
--- a/.markdownlint.yaml
+++ b/.markdownlint.yaml
@@ -10,5 +10,6 @@ line-length:
 no-inline-html:
   allowed_elements:
     - br
+    - img
 
 descriptive-link-text: false
diff --git a/Gemfile b/Gemfile
index 0095530..2673556 100644
--- a/Gemfile
+++ b/Gemfile
@@ -5,7 +5,7 @@
 
 source ENV['GEM_SOURCE'] || 'https://rubygems.org'
 
-group :release do
+group :release, optional: true do
   gem 'faraday-retry', '~> 2.1', require: false
   gem 'github_changelog_generator', '~> 1.18', require: false
 end
diff --git a/RELEASE.md b/RELEASE.md
index c9daceb..55dade6 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -13,7 +13,7 @@ Your attention to this specific branch naming convention is essential for accura
 export RELEASE_VERSION="X.Y.Z"
 git switch main
 git pull --rebase
-git switch -c release-v$RELEASE_VERSION
+git switch --create release-v$RELEASE_VERSION
 
 bundle config set --local path vendor/bundle
 bundle config set --local with 'release'
@@ -21,7 +21,7 @@ bundle install
 
 CHANGELOG_GITHUB_TOKEN="token_MC_tokenface" bundle exec rake changelog
 
-git commit --all --message "Release v${RELEASE_VERSION}"
+git commit --all --signoff --sign --message "Release v${RELEASE_VERSION}"
 git push --set-upstream origin HEAD
 ```
 
@@ -32,6 +32,6 @@ Then open a PR, discuss and merge.
 ```shell
 git switch main
 git pull --rebase
-git tag v$RELEASE_VERSION -m "v$RELEASE_VERSION"
+git tag v$RELEASE_VERSION --sign --message "v$RELEASE_VERSION"
 git push --tags
 ```
diff --git a/Rakefile b/Rakefile
index 8410a57..32b702c 100644
--- a/Rakefile
+++ b/Rakefile
@@ -12,7 +12,7 @@ else
   GitHubChangelogGenerator::RakeTask.new :changelog do |config|
     config.header = "# Changelog\n\nAll notable changes to this project will be documented in this file."
     config.exclude_labels = %w[duplicate question invalid wontfix wont-fix skip-changelog modulesync github_actions]
-    config.user = 'openvoxproject'
+    config.user = 'OpenVoxProject'
     config.project = 'container-openvoxserver'
     # get branch name from git and strip off any prefixes (e.g. 'release-')
     config.future_release = `git rev-parse --abbrev-ref HEAD`.strip.split('-', 2).last
diff --git a/renovate.json b/renovate.json
deleted file mode 100644
index 01ae572..0000000
--- a/renovate.json
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "addLabels": [ "dependencies", "renovate" ],
-  "assigneesFromCodeOwners": true,
-  "automerge": true,
-  "automergeType": "pr",
-  "customManagers": [
-    {
-      "customType": "regex",
-      "datasourceTemplate": "rubygems",
-      "managerFilePatterns": [
-        "/(^|/)Containerfile\\.(?:alpine|ubuntu)$/",
-        "/(^|/)build_versions\\.yaml$/"
-      ],
-      "matchStrings": [
-        "rubygem_(?<depName>[a-z0-9_-]+):\\s*\"(?<currentValue>\\d+\\.\\d+\\.\\d+)\"",
-        "#\\s*renovate:\\s*depName=(?<depName>[a-z0-9_-]+)\\s+datasource=rubygems\\s*\\n\\s*ARG\\s+RUBYGEM_[A-Z0-9_]+=(?<currentValue>\\d+\\.\\d+\\.\\d+)"
-      ]
-    },
-    {
-      "customType": "regex",
-      "datasourceTemplate": "github-tags",
-      "extractVersionTemplate": "^v(?<version>\\d+\\.\\d+\\.\\d+)$",
-      "managerFilePatterns": [
-        "/(^|/)Containerfile\\.(?:alpine|ubuntu)$/"
-      ],
-      "matchStrings": [
-        "#\\s*renovate:\\s*datasource=github-tags\\s+depName=(?<depName>OpenVoxProject/puppetlabs-[a-z0-9_]+)\\s*\\n\\s*ARG\\s+MODULE_[A-Z0-9_]+=(?<currentValue>\\d+\\.\\d+\\.\\d+)"
-      ]
-    },
-    {
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/(^|/)Containerfile\\.(?:alpine|ubuntu)$/",
-        "/(^|/)build_versions\\.yaml$/"
-      ],
-      "matchStrings": [
-        "#\\s*renovate:\\s*datasource=(?<datasource>custom\\.voxpupuli-artifacts)\\s+depName=(?<depName>openvox(?:-server|db))\\s*\\n\\s*(?:ARG\\s+OPENVOX(?:SERVER|DB)_VERSION=|(?:server|db)_version:\\s*\")(?<currentValue>\\d+\\.\\d+\\.\\d+)"
-      ],
-      "versioningTemplate": "semver"
-    }
-  ],
-  "customDatasources": {
-    "voxpupuli-artifacts": {
-      "defaultRegistryUrlTemplate": "https://artifacts.voxpupuli.org/{{packageName}}/",
-      "format": "html"
-    }
-  },
-  "extends": [ "config:recommended", ":prImmediately" ],
-  "vulnerabilityAlerts": {
-    "addLabels": [ "security" ],
-    "enabled": true
-  },
-  "packageRules": [
-    {
-      "matchDatasources": ["custom.voxpupuli-artifacts"],
-      "allowedVersions": "/^8\\./",
-      "extractVersion": "^(?<version>\\d+\\.\\d+\\.\\d+)/$"
-    },
-    {
-      "matchPackagePatterns": [".*"],
-      "dependencyDashboardApproval": false
-    }
-  ]
-}