diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 205c4853..ccbd73c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,30 +4,38 @@ on:
   pull_request:
     branches:
       - "main"
+  pull_request_target:
+    types: [labeled]
+    branches:
+      - "main"
   workflow_dispatch:
-    
+
+permissions:
+  contents: read
+
+concurrency:
+  # On pull_request_target, github.ref is the base branch, so key on the PR number
+  # (and the event) to keep runs of different PRs from cancelling each other. The
+  # label is in the key so that adding another label to the same PR doesn't cancel
+  # its allowed-for-ci acceptance run; re-adding allowed-for-ci still replaces it.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}-${{ github.event.label.name }}
+  cancel-in-progress: true
+
 jobs:
   Spec:
+    if: github.event_name != 'pull_request_target'
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_ci.yml@main"
-    with:
-      # puppet_litmus -> bolt 4.x -> faraday-patron -> patron builds a libcurl native extension;
-      # the runner has no libcurl headers, so install them before bundle (Puppet 9 lane, Ruby 4).
-      additional_packages: "libcurl4-openssl-dev"
-      ruby_version: "3.2"
     secrets: "inherit"
 
   Acceptance:
-    needs: Spec
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.repo.fork == false) ||
+      (github.event_name == 'pull_request_target' &&
+       github.event.pull_request.head.repo.fork == true &&
+       github.event.label.name == 'allowed-for-ci')
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_acceptance.yml@main"
     with:
-      ruby_version: "3.2"
-      flags: >-
-        --nightly
-        --arch-exclude arm
-        --collection-platform-exclude 9:redhat-7
-        --collection-platform-exclude 9:centos-7
-        --collection-platform-exclude 9:oraclelinux-7
-        --collection-platform-exclude 9:debian-10
-        --collection-platform-exclude 9:ubuntu-18.04
-        --collection-platform-exclude 9:ubuntu-20.04
+      flags: "--nightly --arch-exclude arm --collection-platform-exclude 9:redhat-7 --collection-platform-exclude 9:centos-7 --collection-platform-exclude 9:oraclelinux-7 --collection-platform-exclude 9:debian-10 --collection-platform-exclude 9:ubuntu-18.04 --collection-platform-exclude 9:ubuntu-20.04"
     secrets: "inherit"
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index c31d7900..9479dcf5 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -9,24 +9,10 @@ jobs:
   Spec:
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_ci.yml@main"
     secrets: "inherit"
-    with:
-      # puppet_litmus -> bolt 4.x -> faraday-patron -> patron builds a libcurl native extension;
-      # the runner has no libcurl headers, so install them before bundle (Puppet 9 lane, Ruby 4).
-      additional_packages: "libcurl4-openssl-dev"
-      ruby_version: "3.2"
 
   Acceptance:
     needs: Spec
     uses: "puppetlabs/cat-github-actions/.github/workflows/module_acceptance.yml@main"
     with:
-      ruby_version: "3.2"
-      flags: >-
-        --nightly
-        --arch-exclude arm
-        --collection-platform-exclude 9:redhat-7
-        --collection-platform-exclude 9:centos-7
-        --collection-platform-exclude 9:oraclelinux-7
-        --collection-platform-exclude 9:debian-10
-        --collection-platform-exclude 9:ubuntu-18.04
-        --collection-platform-exclude 9:ubuntu-20.04
+      flags: "--nightly --arch-exclude arm --collection-platform-exclude 9:redhat-7 --collection-platform-exclude 9:centos-7 --collection-platform-exclude 9:oraclelinux-7 --collection-platform-exclude 9:debian-10 --collection-platform-exclude 9:ubuntu-18.04 --collection-platform-exclude 9:ubuntu-20.04"
     secrets: "inherit"
diff --git a/.pdkignore b/.pdkignore
index 84684be6..e758847e 100644
--- a/.pdkignore
+++ b/.pdkignore
@@ -43,7 +43,7 @@ bolt-debug.log
 /Rakefile
 /rakelib/
 /.rspec
-/..yml
+/.rubocop.yml
 /.yardopts
 /spec/
 /.vscode/
diff --git a/.puppet-lint.rc b/.puppet-lint.rc
index 9e15c6e0..cd2facd6 100644
--- a/.puppet-lint.rc
+++ b/.puppet-lint.rc
@@ -6,4 +6,5 @@
 --no-autoloader_layout-check
 --no-documentation-check
 --no-single_quote_string_with_variables-check
+--no-strict_indent-check
 --ignore-paths=.vendor/**/*.pp,.bundle/**/*.pp,pkg/**/*.pp,spec/**/*.pp,tests/**/*.pp,types/**/*.pp,vendor/**/*.pp
diff --git a/.rubocop.yml b/.rubocop.yml
index 47b1aadb..8b7b8441 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -1,7 +1,11 @@
 ---
-require:
+plugins:
 - rubocop-performance
+- rubocop-hash_inspect
 - rubocop-rspec
+- rubocop-rspec_rails
+- rubocop-factory_bot
+- rubocop-capybara
 AllCops:
   NewCops: enable
   DisplayCopNames: true
@@ -20,9 +24,15 @@ AllCops:
   - "**/Vagrantfile"
   - "**/Guardfile"
 inherit_from: ".rubocop_todo.yml"
+inherit_mode:
+  merge:
+  - Exclude
 Layout/LineLength:
   Description: People have wide screens, use them.
   Max: 200
+Layout/EndOfLine:
+  Description: We enforce lf to ensure consistency across platforms.
+  EnforcedStyle: lf
 RSpec/BeforeAfterAll:
   Description: Beware of using after(:all) as it may cause state to leak between tests.
     A necessary evil in acceptance testing.
@@ -73,659 +83,73 @@ Style/TrailingCommaInArrayLiteral:
 Style/SymbolArray:
   Description: Using percent style obscures symbolic intent of array's contents.
   EnforcedStyle: brackets
-RSpec/MessageSpies:
-  EnforcedStyle: receive
-Style/Documentation:
-  Exclude:
-  - lib/puppet/parser/functions/**/*
-  - spec/**/*
 Style/WordArray:
+  Description: Using percent style obscures symbolic intent of array's contents.
   EnforcedStyle: brackets
-Performance/AncestorsInclude:
-  Enabled: true
-Performance/BigDecimalWithNumericArgument:
-  Enabled: true
-Performance/BlockGivenWithExplicitBlock:
-  Enabled: true
-Performance/CaseWhenSplat:
-  Enabled: true
-Performance/ConstantRegexp:
-  Enabled: true
-Performance/MethodObjectAsBlock:
-  Enabled: true
-Performance/RedundantSortBlock:
-  Enabled: true
-Performance/RedundantStringChars:
-  Enabled: true
-Performance/ReverseFirst:
-  Enabled: true
-Performance/SortReverse:
-  Enabled: true
-Performance/Squeeze:
-  Enabled: true
-Performance/StringInclude:
-  Enabled: true
-Performance/Sum:
-  Enabled: true
-Style/CollectionMethods:
-  Enabled: true
-Style/MethodCalledOnDoEndBlock:
-  Enabled: true
-Style/StringMethods:
-  Enabled: true
-Bundler/GemFilename:
-  Enabled: false
-Bundler/InsecureProtocolSource:
-  Enabled: false
-Capybara/CurrentPathExpectation:
-  Enabled: false
-Capybara/VisibilityMatcher:
-  Enabled: false
-Gemspec/DuplicatedAssignment:
-  Enabled: false
-Gemspec/OrderedDependencies:
-  Enabled: false
-Gemspec/RequiredRubyVersion:
-  Enabled: false
-Gemspec/RubyVersionGlobalsUsage:
-  Enabled: false
-Layout/ArgumentAlignment:
-  Enabled: false
-Layout/BeginEndAlignment:
-  Enabled: false
-Layout/ClosingHeredocIndentation:
-  Enabled: false
-Layout/EmptyComment:
-  Enabled: false
-Layout/EmptyLineAfterGuardClause:
-  Enabled: false
-Layout/EmptyLinesAroundArguments:
-  Enabled: false
-Layout/EmptyLinesAroundAttributeAccessor:
-  Enabled: false
-Layout/EndOfLine:
-  Enabled: false
-Layout/FirstArgumentIndentation:
-  Enabled: false
-Layout/HashAlignment:
-  Enabled: false
-Layout/HeredocIndentation:
-  Enabled: false
-Layout/LeadingEmptyLines:
-  Enabled: false
-Layout/SpaceAroundMethodCallOperator:
-  Enabled: false
-Layout/SpaceInsideArrayLiteralBrackets:
-  Enabled: false
-Layout/SpaceInsideReferenceBrackets:
-  Enabled: false
-Lint/BigDecimalNew:
-  Enabled: false
-Lint/BooleanSymbol:
-  Enabled: false
-Lint/ConstantDefinitionInBlock:
-  Enabled: false
-Lint/DeprecatedOpenSSLConstant:
-  Enabled: false
-Lint/DisjunctiveAssignmentInConstructor:
-  Enabled: false
-Lint/DuplicateElsifCondition:
-  Enabled: false
-Lint/DuplicateRequire:
-  Enabled: false
-Lint/DuplicateRescueException:
-  Enabled: false
-Lint/EmptyConditionalBody:
-  Enabled: false
-Lint/EmptyFile:
-  Enabled: false
-Lint/ErbNewArguments:
-  Enabled: false
-Lint/FloatComparison:
-  Enabled: false
-Lint/HashCompareByIdentity:
-  Enabled: false
-Lint/IdentityComparison:
-  Enabled: false
-Lint/InterpolationCheck:
-  Enabled: false
-Lint/MissingCopEnableDirective:
-  Enabled: false
-Lint/MixedRegexpCaptureTypes:
-  Enabled: false
-Lint/NestedPercentLiteral:
-  Enabled: false
-Lint/NonDeterministicRequireOrder:
-  Enabled: false
-Lint/OrderedMagicComments:
-  Enabled: false
-Lint/OutOfRangeRegexpRef:
-  Enabled: false
-Lint/RaiseException:
-  Enabled: false
-Lint/RedundantCopEnableDirective:
-  Enabled: false
-Lint/RedundantRequireStatement:
-  Enabled: false
-Lint/RedundantSafeNavigation:
-  Enabled: false
-Lint/RedundantWithIndex:
-  Enabled: false
-Lint/RedundantWithObject:
-  Enabled: false
-Lint/RegexpAsCondition:
-  Enabled: false
-Lint/ReturnInVoidContext:
-  Enabled: false
-Lint/SafeNavigationConsistency:
-  Enabled: false
-Lint/SafeNavigationWithEmpty:
-  Enabled: false
-Lint/SelfAssignment:
-  Enabled: false
-Lint/SendWithMixinArgument:
-  Enabled: false
-Lint/ShadowedArgument:
-  Enabled: false
-Lint/StructNewOverride:
-  Enabled: false
-Lint/ToJSON:
-  Enabled: false
-Lint/TopLevelReturnWithArgument:
-  Enabled: false
-Lint/TrailingCommaInAttributeDeclaration:
-  Enabled: false
-Lint/UnreachableLoop:
-  Enabled: false
-Lint/UriEscapeUnescape:
-  Enabled: false
-Lint/UriRegexp:
-  Enabled: false
-Lint/UselessMethodDefinition:
-  Enabled: false
-Lint/UselessTimes:
-  Enabled: false
-Metrics/AbcSize:
-  Enabled: false
-Metrics/BlockLength:
-  Enabled: false
-Metrics/BlockNesting:
-  Enabled: false
-Metrics/ClassLength:
-  Enabled: false
-Metrics/CyclomaticComplexity:
-  Enabled: false
-Metrics/MethodLength:
-  Enabled: false
-Metrics/ModuleLength:
-  Enabled: false
-Metrics/ParameterLists:
-  Enabled: false
-Metrics/PerceivedComplexity:
-  Enabled: false
-Migration/DepartmentName:
-  Enabled: false
-Naming/AccessorMethodName:
-  Enabled: false
-Naming/BlockParameterName:
-  Enabled: false
-Naming/HeredocDelimiterCase:
-  Enabled: false
-Naming/HeredocDelimiterNaming:
-  Enabled: false
-Naming/MemoizedInstanceVariableName:
-  Enabled: false
-Naming/MethodParameterName:
-  Enabled: false
-Naming/RescuedExceptionsVariableName:
-  Enabled: false
-Naming/VariableNumber:
-  Enabled: false
-Performance/BindCall:
-  Enabled: false
-Performance/DeletePrefix:
-  Enabled: false
-Performance/DeleteSuffix:
-  Enabled: false
-Performance/InefficientHashSearch:
-  Enabled: false
-Performance/UnfreezeString:
-  Enabled: false
-Performance/UriDefaultParser:
-  Enabled: false
-RSpec/Be:
-  Enabled: false
-RSpec/Capybara/FeatureMethods:
-  Enabled: false
-RSpec/ContainExactly:
-  Enabled: false
-RSpec/ContextMethod:
-  Enabled: false
-RSpec/ContextWording:
-  Enabled: false
+Style/TrailingCommaInHashLiteral:
+  Description: PDK generates multiline hashes with trailing commas. Align with Style/TrailingCommaInArguments
+    and Style/TrailingCommaInArrayLiteral (both comma) so hash literals follow the
+    same project style.
+  EnforcedStyleForMultiline: comma
 RSpec/DescribeClass:
+  Description: rspec-puppet describes its subject by string class/define name (no
+    Ruby constant exists to reference), so this cop is never satisfiable for puppet
+    specs. This is structurally inapplicable, not a style preference -- distinct from
+    D-08 which governs style cops.
   Enabled: false
-RSpec/EmptyHook:
-  Enabled: false
-RSpec/EmptyLineAfterExample:
-  Enabled: false
-RSpec/EmptyLineAfterExampleGroup:
-  Enabled: false
-RSpec/EmptyLineAfterHook:
-  Enabled: false
+RSpec/MessageSpies:
+  Description: PDK-generated specs and the rspec-puppet convention use the mock-style
+    `expect(...).to receive(...)` idiom throughout, not RuboCop's default spy-style
+    `have_received`. Restores the setting the old `strict` profile applied globally
+    (no Exclude needed -- provider/transport specs already comply).
+  EnforcedStyle: receive
 RSpec/ExampleLength:
-  Enabled: false
-RSpec/ExampleWithoutDescription:
-  Enabled: false
-RSpec/ExpectChange:
-  Enabled: false
-RSpec/ExpectInHook:
-  Enabled: false
-RSpec/FactoryBot/AttributeDefinedStatically:
-  Enabled: false
-RSpec/FactoryBot/CreateList:
-  Enabled: false
-RSpec/FactoryBot/FactoryClassName:
-  Enabled: false
-RSpec/HooksBeforeExamples:
-  Enabled: false
-RSpec/ImplicitBlockExpectation:
-  Enabled: false
-RSpec/ImplicitSubject:
-  Enabled: false
-RSpec/LeakyConstantDeclaration:
-  Enabled: false
-RSpec/LetBeforeExamples:
-  Enabled: false
-RSpec/MatchArray:
-  Enabled: false
-RSpec/MissingExampleGroupArgument:
-  Enabled: false
+  Description: The resource-API provider specs PDK generates contain multi-line examples
+    covering multiple CRUD operations. Scoped to PDK-generated provider and transport
+    spec paths only (D-08).
+  Exclude:
+  - spec/unit/puppet/provider/**/*_spec.rb
+  - spec/unit/puppet/transport/**/*_spec.rb
 RSpec/MultipleExpectations:
-  Enabled: false
-RSpec/MultipleMemoizedHelpers:
-  Enabled: false
-RSpec/MultipleSubjects:
-  Enabled: false
-RSpec/NestedGroups:
-  Enabled: false
-RSpec/PredicateMatcher:
-  Enabled: false
-RSpec/ReceiveCounts:
-  Enabled: false
-RSpec/ReceiveNever:
-  Enabled: false
-RSpec/RepeatedExampleGroupBody:
-  Enabled: false
-RSpec/RepeatedExampleGroupDescription:
-  Enabled: false
-RSpec/RepeatedIncludeExample:
-  Enabled: false
-RSpec/ReturnFromStub:
-  Enabled: false
-RSpec/SharedExamples:
-  Enabled: false
-RSpec/StubbedMock:
-  Enabled: false
-RSpec/UnspecifiedException:
-  Enabled: false
-RSpec/VariableDefinition:
-  Enabled: false
-RSpec/VoidExpect:
-  Enabled: false
-RSpec/Yield:
-  Enabled: false
-Security/Open:
-  Enabled: false
-Style/AccessModifierDeclarations:
-  Enabled: false
-Style/AccessorGrouping:
-  Enabled: false
-Style/BisectedAttrAccessor:
-  Enabled: false
-Style/CaseLikeIf:
-  Enabled: false
-Style/ClassEqualityComparison:
-  Enabled: false
-Style/ColonMethodDefinition:
-  Enabled: false
-Style/CombinableLoops:
-  Enabled: false
-Style/CommentedKeyword:
-  Enabled: false
-Style/Dir:
-  Enabled: false
-Style/DoubleCopDisableDirective:
-  Enabled: false
-Style/EmptyBlockParameter:
-  Enabled: false
-Style/EmptyLambdaParameter:
-  Enabled: false
-Style/Encoding:
-  Enabled: false
-Style/EvalWithLocation:
-  Enabled: false
-Style/ExpandPathArguments:
-  Enabled: false
-Style/ExplicitBlockArgument:
-  Enabled: false
-Style/ExponentialNotation:
-  Enabled: false
-Style/FloatDivision:
-  Enabled: false
-Style/FrozenStringLiteralComment:
-  Enabled: false
-Style/GlobalStdStream:
-  Enabled: false
-Style/HashAsLastArrayItem:
-  Enabled: false
-Style/HashLikeCase:
-  Enabled: false
-Style/HashTransformKeys:
-  Enabled: false
-Style/HashTransformValues:
-  Enabled: false
-Style/IfUnlessModifier:
-  Enabled: false
-Style/KeywordParametersOrder:
-  Enabled: false
-Style/MinMax:
-  Enabled: false
+  Description: The resource-API provider specs PDK generates use multiple expectations
+    per example to cover resource attribute checks. Scoped to PDK-generated provider
+    and transport spec paths only (D-08).
+  Exclude:
+  - spec/unit/puppet/provider/**/*_spec.rb
+  - spec/unit/puppet/transport/**/*_spec.rb
+RSpec/VerifiedDoubleReference:
+  Description: The resource-API provider and transport specs PDK generates use string-referenced
+    instance doubles (the Puppet provider constant is not loaded in the spec context).
+    Scoped to PDK-generated provider and transport spec paths only (D-08).
+  Exclude:
+  - spec/unit/puppet/provider/**/*_spec.rb
+  - spec/unit/puppet/transport/**/*_spec.rb
+RSpec/ContextWording:
+  Description: rspec-puppet-facts uses the `context "on
+  Prefixes:
+  - when
+  - with
+  - without
+  - 'on'
 Style/MixinUsage:
-  Enabled: false
-Style/MultilineWhenThen:
-  Enabled: false
-Style/NegatedUnless:
-  Enabled: false
-Style/NumericPredicate:
-  Enabled: false
-Style/OptionalBooleanParameter:
-  Enabled: false
-Style/OrAssignment:
-  Enabled: false
-Style/RandomWithOffset:
-  Enabled: false
-Style/RedundantAssignment:
-  Enabled: false
-Style/RedundantCondition:
-  Enabled: false
-Style/RedundantConditional:
-  Enabled: false
-Style/RedundantFetchBlock:
-  Enabled: false
-Style/RedundantFileExtensionInRequire:
-  Enabled: false
-Style/RedundantRegexpCharacterClass:
-  Enabled: false
-Style/RedundantRegexpEscape:
-  Enabled: false
-Style/RedundantSelfAssignment:
-  Enabled: false
-Style/RedundantSort:
-  Enabled: false
-Style/RescueStandardError:
-  Enabled: false
-Style/SingleArgumentDig:
-  Enabled: false
-Style/SlicingWithRange:
-  Enabled: false
-Style/SoleNestedConditional:
-  Enabled: false
-Style/StderrPuts:
-  Enabled: false
-Style/StringConcatenation:
-  Enabled: false
-Style/Strip:
-  Enabled: false
-Style/SymbolProc:
-  Enabled: false
-Style/TrailingBodyOnClass:
-  Enabled: false
-Style/TrailingBodyOnMethodDefinition:
-  Enabled: false
-Style/TrailingBodyOnModule:
-  Enabled: false
-Style/TrailingCommaInHashLiteral:
-  Enabled: false
-Style/TrailingMethodEndStatement:
-  Enabled: false
-Style/UnpackFirst:
-  Enabled: false
-Capybara/MatchStyle:
-  Enabled: false
-Capybara/NegationMatcher:
-  Enabled: false
-Capybara/SpecificActions:
-  Enabled: false
-Capybara/SpecificFinders:
-  Enabled: false
-Capybara/SpecificMatcher:
-  Enabled: false
-Gemspec/DeprecatedAttributeAssignment:
-  Enabled: false
-Gemspec/DevelopmentDependencies:
-  Enabled: false
-Gemspec/RequireMFA:
-  Enabled: false
-Layout/LineContinuationLeadingSpace:
-  Enabled: false
-Layout/LineContinuationSpacing:
-  Enabled: false
-Layout/LineEndStringConcatenationIndentation:
-  Enabled: false
-Layout/SpaceBeforeBrackets:
-  Enabled: false
-Lint/AmbiguousAssignment:
-  Enabled: false
-Lint/AmbiguousOperatorPrecedence:
-  Enabled: false
-Lint/AmbiguousRange:
-  Enabled: false
-Lint/ConstantOverwrittenInRescue:
-  Enabled: false
-Lint/DeprecatedConstants:
-  Enabled: false
-Lint/DuplicateBranch:
-  Enabled: false
-Lint/DuplicateMagicComment:
-  Enabled: false
-Lint/DuplicateMatchPattern:
-  Enabled: false
-Lint/DuplicateRegexpCharacterClassElement:
-  Enabled: false
-Lint/EmptyBlock:
-  Enabled: false
+  Description: rspec-puppet-facts requires the top-level `include RspecPuppetFacts`
+    idiom in spec_helper, which cannot be cleanly restructured without breaking the
+    facts test harness. Scoped to spec_helper only (D-07).
+  Exclude:
+  - spec/spec_helper.rb
 Lint/EmptyClass:
-  Enabled: false
-Lint/EmptyInPattern:
-  Enabled: false
-Lint/IncompatibleIoSelectWithFiberScheduler:
-  Enabled: false
-Lint/LambdaWithoutLiteralBlock:
-  Enabled: false
-Lint/NoReturnInBeginEndBlocks:
-  Enabled: false
-Lint/NonAtomicFileOperation:
-  Enabled: false
-Lint/NumberedParameterAssignment:
-  Enabled: false
-Lint/OrAssignmentToConstant:
-  Enabled: false
-Lint/RedundantDirGlobSort:
-  Enabled: false
-Lint/RefinementImportMethods:
-  Enabled: false
-Lint/RequireRangeParentheses:
-  Enabled: false
-Lint/RequireRelativeSelfPath:
-  Enabled: false
-Lint/SymbolConversion:
-  Enabled: false
-Lint/ToEnumArguments:
-  Enabled: false
-Lint/TripleQuotes:
-  Enabled: false
-Lint/UnexpectedBlockArity:
-  Enabled: false
-Lint/UnmodifiedReduceAccumulator:
-  Enabled: false
-Lint/UselessRescue:
-  Enabled: false
-Lint/UselessRuby2Keywords:
-  Enabled: false
-Metrics/CollectionLiteralLength:
-  Enabled: false
-Naming/BlockForwarding:
-  Enabled: false
-Performance/CollectionLiteralInLoop:
-  Enabled: false
-Performance/ConcurrentMonotonicTime:
-  Enabled: false
-Performance/MapCompact:
-  Enabled: false
-Performance/RedundantEqualityComparisonBlock:
-  Enabled: false
-Performance/RedundantSplitRegexpArgument:
-  Enabled: false
-Performance/StringIdentifierArgument:
-  Enabled: false
-RSpec/BeEq:
-  Enabled: false
-RSpec/BeNil:
-  Enabled: false
-RSpec/ChangeByZero:
-  Enabled: false
-RSpec/ClassCheck:
-  Enabled: false
-RSpec/DuplicatedMetadata:
-  Enabled: false
-RSpec/ExcessiveDocstringSpacing:
-  Enabled: false
-RSpec/FactoryBot/ConsistentParenthesesStyle:
-  Enabled: false
-RSpec/FactoryBot/FactoryNameStyle:
-  Enabled: false
-RSpec/FactoryBot/SyntaxMethods:
-  Enabled: false
-RSpec/IdenticalEqualityAssertion:
-  Enabled: false
-RSpec/NoExpectationExample:
-  Enabled: false
-RSpec/PendingWithoutReason:
-  Enabled: false
-RSpec/Rails/AvoidSetupHook:
-  Enabled: false
-RSpec/Rails/HaveHttpStatus:
-  Enabled: false
-RSpec/Rails/InferredSpecType:
-  Enabled: false
-RSpec/Rails/MinitestAssertions:
-  Enabled: false
-RSpec/Rails/TravelAround:
-  Enabled: false
-RSpec/RedundantAround:
-  Enabled: false
-RSpec/SkipBlockInsideExample:
-  Enabled: false
-RSpec/SortMetadata:
-  Enabled: false
-RSpec/SubjectDeclaration:
-  Enabled: false
-RSpec/VerifiedDoubleReference:
-  Enabled: false
-Security/CompoundHash:
-  Enabled: false
-Security/IoMethods:
-  Enabled: false
-Style/ArgumentsForwarding:
-  Enabled: false
-Style/ArrayIntersect:
-  Enabled: false
-Style/CollectionCompact:
-  Enabled: false
-Style/ComparableClamp:
-  Enabled: false
-Style/ConcatArrayLiterals:
-  Enabled: false
-Style/DataInheritance:
-  Enabled: false
-Style/DirEmpty:
-  Enabled: false
-Style/DocumentDynamicEvalDefinition:
-  Enabled: false
-Style/EmptyHeredoc:
-  Enabled: false
-Style/EndlessMethod:
-  Enabled: false
-Style/EnvHome:
-  Enabled: false
-Style/FetchEnvVar:
-  Enabled: false
-Style/FileEmpty:
-  Enabled: false
-Style/FileRead:
-  Enabled: false
-Style/FileWrite:
-  Enabled: false
-Style/HashConversion:
-  Enabled: false
-Style/HashExcept:
-  Enabled: false
-Style/IfWithBooleanLiteralBranches:
-  Enabled: false
-Style/InPatternThen:
-  Enabled: false
-Style/MagicCommentFormat:
-  Enabled: false
-Style/MapCompactWithConditionalBlock:
-  Enabled: false
-Style/MapToHash:
-  Enabled: false
-Style/MapToSet:
-  Enabled: false
-Style/MinMaxComparison:
-  Enabled: false
-Style/MultilineInPatternThen:
-  Enabled: false
-Style/NegatedIfElseCondition:
-  Enabled: false
-Style/NestedFileDirname:
-  Enabled: false
-Style/NilLambda:
-  Enabled: false
-Style/NumberedParameters:
-  Enabled: false
-Style/NumberedParametersLimit:
-  Enabled: false
-Style/ObjectThen:
-  Enabled: false
-Style/OpenStructUse:
-  Enabled: false
-Style/OperatorMethodCall:
-  Enabled: false
-Style/QuotedSymbols:
-  Enabled: false
-Style/RedundantArgument:
-  Enabled: false
-Style/RedundantConstantBase:
-  Enabled: false
-Style/RedundantDoubleSplatHashBraces:
-  Enabled: false
-Style/RedundantEach:
-  Enabled: false
-Style/RedundantHeredocDelimiterQuotes:
-  Enabled: false
-Style/RedundantInitialize:
-  Enabled: false
-Style/RedundantLineContinuation:
-  Enabled: false
-Style/RedundantSelfAssignmentBranch:
-  Enabled: false
-Style/RedundantStringEscape:
-  Enabled: false
-Style/SelectByRegexp:
-  Enabled: false
-Style/StringChars:
-  Enabled: false
-Style/SwapValues:
-  Enabled: false
+  Description: The generated transport device file uses the idiomatic Ruby namespace
+    forward-declaration `class Puppet::Util::NetworkDevice; end`. An empty class is
+    the standard namespace-shim idiom here and is not non-idiomatic code. Scoped to
+    the network_device path only (D-08).
+  Exclude:
+  - lib/puppet/util/network_device/**/*.rb
+Lint/BooleanSymbol:
+  Description: Puppet types and providers use the symbols :true and :false as parameter
+    and property values (e.g. newvalues(:true, :false)), and specs set and assert
+    them. Autocorrecting them to true/false breaks the types. Scoped to type, provider
+    and spec paths, matching puppet's own .rubocop.yml.
+  Exclude:
+  - lib/puppet/type/**/*.rb
+  - lib/puppet/provider/**/*.rb
+  - spec/**/*.rb
diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index 32286ea0..420022b2 100644
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -1,14 +1,38 @@
 # This configuration was generated by
-# `rubocop --auto-gen-config`
-# on 2023-11-28 05:16:01 UTC using RuboCop version 1.48.1.
+# `rubocop --auto-gen-config --no-exclude-limit`
+# on 2026-11-13 05:17:28 UTC using RuboCop version 1.73.2.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle.
+# SupportedStyles: hash, symbol
+RSpec/MetadataStyle:
+  Exclude:
+    - 'spec/unit/facter/java_version_spec.rb'
+
+# Offense count: 4
+# Configuration parameters: Max.
+RSpec/MultipleExpectations:
+  Exclude:
+    - 'spec/acceptance/install_spec.rb'
+    - 'spec/unit/facter/java_default_home_spec.rb'
+    - 'spec/unit/facter/java_version_spec.rb'
+
 # Offense count: 2
 # Configuration parameters: EnforcedStyle, IgnoreSharedExamples.
 # SupportedStyles: always, named_only
 RSpec/NamedSubject:
   Exclude:
     - 'spec/defines/download_spec.rb'
+
+# Offense count: 12
+# Configuration parameters: AllowedPatterns.
+# AllowedPatterns: ^expect_, ^assert_
+RSpec/NoExpectationExample:
+  Exclude:
+    - 'spec/acceptance/install_spec.rb'
+    - 'spec/unit/facter/java_default_home_spec.rb'
diff --git a/.sync.yml b/.sync.yml
index 9d1f2924..de6e4e52 100644
--- a/.sync.yml
+++ b/.sync.yml
@@ -16,10 +16,34 @@ spec/spec_helper.rb:
   unmanaged: false
 .github/workflows/ci.yml:
   unmanaged: false
+  # acceptance flags set by hand (Puppet 9 platform excludes) (MODULES-11997 pdk update)
+  acceptance_flags:
+  - "--nightly"
+  - "--arch-exclude arm"
+  - "--collection-platform-exclude 9:redhat-7"
+  - "--collection-platform-exclude 9:centos-7"
+  - "--collection-platform-exclude 9:oraclelinux-7"
+  - "--collection-platform-exclude 9:debian-10"
+  - "--collection-platform-exclude 9:ubuntu-18.04"
+  - "--collection-platform-exclude 9:ubuntu-20.04"
 .github/workflows/nightly.yml:
   unmanaged: false
   cron: '50 0 * * *'
+  # acceptance flags set by hand (Puppet 9 platform excludes) (MODULES-11997 pdk update)
+  acceptance_flags:
+  - "--nightly"
+  - "--arch-exclude arm"
+  - "--collection-platform-exclude 9:redhat-7"
+  - "--collection-platform-exclude 9:centos-7"
+  - "--collection-platform-exclude 9:oraclelinux-7"
+  - "--collection-platform-exclude 9:debian-10"
+  - "--collection-platform-exclude 9:ubuntu-18.04"
+  - "--collection-platform-exclude 9:ubuntu-20.04"
 .github/workflows/release.yml:
   unmanaged: false
 .travis.yml:
   delete: true
+Rakefile:
+  # puppet-lint checks the module disabled by hand (Rakefile/.puppet-lint.rc) (MODULES-11997 pdk update)
+  extra_disabled_lint_checks:
+  - strict_indent
diff --git a/Gemfile b/Gemfile
index 4d58393e..3e1ac2df 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,14 +1,25 @@
 # frozen_string_literal: true
 
-# For puppetcore, set GEM_SOURCE_PUPPETCORE = 'https://rubygems-puppetcore.puppet.com'
+# Defaults to puppetcore regardless of PUPPET_FORGE_TOKEN/network state.
+# Opt out: bundle config set gemsource.public true
 gemsource_default = ENV['GEM_SOURCE'] || 'https://rubygems.org'
-gemsource_puppetcore = if ENV['PUPPET_FORGE_TOKEN']
-  'https://rubygems-puppetcore.puppet.com'
+gemsource_public_opt_out = Bundler.settings['gemsource.public']
+gemsource_puppetcore = if gemsource_public_opt_out
+  gemsource_default
 else
-  ENV['GEM_SOURCE_PUPPETCORE'] || gemsource_default
+  'https://rubygems-puppetcore.puppet.com'
 end
 source gemsource_default
 
+unless ENV['PUPPET_FORGE_TOKEN'] || ENV['BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM'] ||
+       Bundler.settings['gemsource.airgapped'] || gemsource_public_opt_out
+  Bundler.ui.warn <<~WARNING
+    No puppetcore credentials detected.
+    On an airgapped install, run `bundle config set gemsource.airgapped true` to suppress this warning.
+    To use public gems instead, run `bundle config set gemsource.public true`.
+  WARNING
+end
+
 def location_for(place_or_constraint, fake_constraint = nil, opts = {})
   git_url_regex  = /\A(?<url>(?:https?|git)[:@][^#]*)(?:#(?<branch>.*))?/
   file_url_regex = %r{\Afile://(?<path>.*)}
@@ -27,6 +38,17 @@ def location_for(place_or_constraint, fake_constraint = nil, opts = {})
   end
 end
 
+# Works around a bundler multi_json/puppet resolution bug - see pdk-templates/docs/adr/0001.
+def puppet_floor_version(puppetcore_source)
+  return nil if puppetcore_source == 'https://rubygems.org'
+
+  ruby_version = Gem::Version.new(RUBY_VERSION.dup)
+  return '~> 9.0' if Gem::Requirement.create('>= 3.4.0').satisfied_by?(ruby_version)
+  return '~> 8.17' if Gem::Requirement.create('>= 3.1.0').satisfied_by?(ruby_version)
+
+  nil # puppet 8+ requires ruby >= 3.1; leave older rubies unconstrained
+end
+
 # Print debug information if DEBUG_GEMS or VERBOSE is set
 def print_gem_statement_for(gems)
   puts 'DEBUG: Gem definitions that will be generated:'
@@ -38,9 +60,11 @@ end
 group :development do
   gem "json", '= 2.6.1',                         require: false if Gem::Requirement.create(['>= 3.1.0', '< 3.1.3']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "json", '= 2.6.3',                         require: false if Gem::Requirement.create(['>= 3.2.0', '< 4.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
+  gem "json", '= 2.18.0',                        require: false if Gem::Requirement.create(['>= 4.0.0', '< 5.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "racc", '~> 1.4.0',                        require: false if Gem::Requirement.create(['>= 2.7.0', '< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "deep_merge", '~> 1.2.2',                  require: false
-  gem "voxpupuli-puppet-lint-plugins", '~> 7.0', require: false
+  gem "voxpupuli-puppet-lint-plugins", '~> 7.0', require: false if gemsource_puppetcore != "https://rubygems.org"
+  gem "voxpupuli-puppet-lint-plugins", '~> 6.0', require: false if gemsource_puppetcore == "https://rubygems.org"
   gem "facterdb", '~> 2.1',                      require: false if Gem::Requirement.create(['< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "facterdb", '~> 3.0',                      require: false if Gem::Requirement.create(['>= 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "metadata-json-lint", '~> 4.0',            require: false
@@ -52,29 +76,36 @@ group :development do
   gem "pry", '~> 0.10',                          require: false
   gem "simplecov-console", '~> 0.9',             require: false
   gem "puppet-debugger", '~> 1.6',               require: false
-  gem "rubocop", '~> 1.50.0',                    require: false
-  gem "rubocop-performance", '= 1.16.0',         require: false
-  gem "rubocop-rspec", '= 2.19.0',               require: false
-  gem "rb-readline", '= 0.5.5',                  require: false, platforms: [:mswin, :mingw, :x64_mingw]
-  gem "bigdecimal", '< 3.2.2',                   require: false, platforms: [:mswin, :mingw, :x64_mingw]
+  gem "rubocop", '~> 1.73.0',                    require: false
+  gem "rubocop-performance", '~> 1.24.0',        require: false
+  gem "rubocop-hash_inspect", '~> 0.2',          require: false
+  gem "rubocop-rspec", '~> 3.5.0',               require: false
+  gem "rubocop-rspec_rails", '~> 2.31.0',        require: false
+  gem "rubocop-factory_bot", '~> 2.27.0',        require: false
+  gem "rubocop-capybara", '~> 2.22.0',           require: false
+  gem "rb-readline", '= 0.5.5',                  require: false, platforms: [:windows]
+  gem "bigdecimal", '< 3.2.2',                   require: false, platforms: [:windows]
 end
 group :development, :release_prep do
-  gem "puppet-strings", '~> 4.0',         require: false
-  gem "puppetlabs_spec_helper", '~> 9.0', require: false
-  gem "puppet-blacksmith", '~> 7.0',      require: false
+  gem "puppet-strings", '>= 4.0', '< 6.0',     require: false
+  gem "puppetlabs_spec_helper", '~> 9.0',      require: false if gemsource_puppetcore != "https://rubygems.org"
+  gem "puppetlabs_spec_helper", '~> 8.0',      require: false if gemsource_puppetcore == "https://rubygems.org"
+  gem "puppet-blacksmith", '>= 7.0', '< 10.0', require: false
 end
 group :system_tests do
-  gem "puppet_litmus", '~> 2.0',   require: false, platforms: [:ruby, :x64_mingw] if !ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
-  gem "puppet_litmus", '~> 1.0',   require: false, platforms: [:ruby, :x64_mingw] if ENV['PUPPET_FORGE_TOKEN'].to_s.empty?
-  gem "CFPropertyList", '< 3.0.7', require: false, platforms: [:mswin, :mingw, :x64_mingw]
+  gem "puppet_litmus", '~> 2.5',   require: false
+  gem "faraday", '~> 2.5',         require: false
+  gem "CFPropertyList", '< 3.0.7', require: false if RUBY_PLATFORM.include?('darwin')
   gem "serverspec", '~> 2.41',     require: false
 end
 
 gems = {}
-puppet_version = ENV.fetch('PUPPET_GEM_VERSION', nil)
+bolt_version = ENV.fetch('BOLT_GEM_VERSION', nil)
+puppet_version = ENV.fetch('PUPPET_GEM_VERSION', puppet_floor_version(gemsource_puppetcore))
 facter_version = ENV.fetch('FACTER_GEM_VERSION', nil)
 hiera_version = ENV.fetch('HIERA_GEM_VERSION', nil)
 
+gems['bolt'] = location_for(bolt_version, nil, { source: gemsource_puppetcore })
 gems['puppet'] = location_for(puppet_version, nil, { source: gemsource_puppetcore })
 gems['facter'] = location_for(facter_version, nil, { source: gemsource_puppetcore })
 gems['hiera'] = location_for(hiera_version, nil, {}) if hiera_version
diff --git a/Rakefile b/Rakefile
index 62ba8799..7c48cb40 100644
--- a/Rakefile
+++ b/Rakefile
@@ -3,7 +3,8 @@
 require 'bundler'
 require 'puppet_litmus/rake_tasks' if Gem.loaded_specs.key? 'puppet_litmus'
 require 'puppetlabs_spec_helper/rake_tasks'
-require 'puppetlabs-syntax/tasks/puppetlabs-syntax'
+require 'puppet-syntax/tasks/puppet-syntax' if Gem.loaded_specs.key? 'puppet-syntax'
+require 'puppetlabs-syntax/tasks/puppetlabs-syntax' if Gem.loaded_specs.key? 'puppetlabs-syntax'
 require 'puppet-strings/tasks' if Gem.loaded_specs.key? 'puppet-strings'
 
 PuppetLint.configuration.send('disable_relative')
@@ -13,10 +14,6 @@ PuppetLint.configuration.send('disable_class_inherits_from_params_class')
 PuppetLint.configuration.send('disable_autoloader_layout')
 PuppetLint.configuration.send('disable_documentation')
 PuppetLint.configuration.send('disable_single_quote_string_with_variables')
-# strict_indent is disabled because its expected indentation changed incompatibly
-# between puppet-lint-strict_indent-check 3.x (Puppet 7/8 lane, Ruby 3.1) and 5.x
-# (Puppet 9 lane, Ruby 3.4+): the two lanes demand opposite indentation for nested
-# hashes, so no single manifest layout can satisfy both. See MODULES-11704 / MODULES-11700.
 PuppetLint.configuration.send('disable_strict_indent')
 PuppetLint.configuration.fail_on_warnings = true
 PuppetLint.configuration.ignore_paths = [".vendor/**/*.pp", ".bundle/**/*.pp", "pkg/**/*.pp", "spec/**/*.pp", "tests/**/*.pp", "types/**/*.pp", "vendor/**/*.pp"]
diff --git a/lib/facter/java_default_home.rb b/lib/facter/java_default_home.rb
index a93a13ae..12a4c775 100644
--- a/lib/facter/java_default_home.rb
+++ b/lib/facter/java_default_home.rb
@@ -22,9 +22,9 @@
     else
       java_path = File.realpath(java_bin)
       java_default_home = if java_path.include?('/jre/')
-                            File.dirname(File.dirname(File.dirname(java_path)))
+                            File.dirname(java_path, 3)
                           else
-                            File.dirname(File.dirname(java_path))
+                            File.dirname(java_path, 2)
                           end
     end
   end
diff --git a/metadata.json b/metadata.json
index 4c33d6bd..6177e713 100644
--- a/metadata.json
+++ b/metadata.json
@@ -86,6 +86,6 @@
     }
   ],
   "template-url": "https://github.com/puppetlabs/pdk-templates.git#main",
-  "template-ref": "tags/3.5.1-0-g9d5b193",
-  "pdk-version": "3.5.0"
+  "template-ref": "heads/main-0-g8ca954f",
+  "pdk-version": "4.0.1"
 }
diff --git a/spec/classes/java_spec.rb b/spec/classes/java_spec.rb
index fa327bfd..311adbc3 100644
--- a/spec/classes/java_spec.rb
+++ b/spec/classes/java_spec.rb
@@ -202,7 +202,7 @@
           'package' => 'custom_jdk',
           'java_alternative' => 'java-custom_jdk',
           'java_alternative_path' => '/opt/custom_jdk/bin/java',
-          'java_home' => '/opt/custom_jdk'
+          'java_home' => '/opt/custom_jdk',
         }
       end
 
@@ -215,7 +215,7 @@
       let(:params) do
         {
           'distribution' => 'custom',
-          'package' => 'custom_jdk'
+          'package' => 'custom_jdk',
         }
       end
 
@@ -231,36 +231,36 @@
         os: {
           family: 'windows',
           name: 'windows',
-          release: { full: '8.1' }
-        }
+          release: { full: '8.1' },
+        },
       },
       {
         os: {
           family: 'Darwin',
           name: 'Darwin',
-          release: { full: '13.3.0' }
-        }
+          release: { full: '13.3.0' },
+        },
       },
       {
         os: {
           family: 'AIX',
           name: 'AIX',
-          release: { full: '7100-02-00-000' }
-        }
+          release: { full: '7100-02-00-000' },
+        },
       },
       {
         os: {
           family: 'AIX',
           name: 'AIX',
-          release: { full: '6100-07-04-1216' }
-        }
+          release: { full: '6100-07-04-1216' },
+        },
       },
       {
         os: {
           family: 'AIX',
           name: 'AIX',
-          release: { full: '5300-12-01-1016' }
-        }
+          release: { full: '5300-12-01-1016' },
+        },
       },
     ].each do |facts|
       let(:facts) { facts }
diff --git a/spec/defines/adopt_spec.rb b/spec/defines/adopt_spec.rb
index c56fc48a..82ae4607 100644
--- a/spec/defines/adopt_spec.rb
+++ b/spec/defines/adopt_spec.rb
@@ -14,7 +14,7 @@
           java: 'jdk',
           basedir: '/usr/java',
           manage_symlink: true,
-          symlink_name: 'java_home'
+          symlink_name: 'java_home',
         }
       end
       let(:title) { 'jdk11_symlink' }
@@ -125,7 +125,7 @@
           ensure: 'present',
           version_major: '8u202',
           version_minor: 'b08',
-          java: 'jdk'
+          java: 'jdk',
         }
       end
       let(:title) { 'jdk8' }
@@ -152,7 +152,7 @@
           version: '8',
           java: 'jdk',
           basedir: '/usr/java',
-          package_type: 'tar.gz'
+          package_type: 'tar.gz',
         }
       end
       let(:title) { 'jdk8' }
@@ -169,7 +169,7 @@
           version: '8',
           java: 'jdk',
           basedir: '/usr/java',
-          manage_basedir: true
+          manage_basedir: true,
         }
       end
       let(:title) { 'jdk8' }
@@ -277,7 +277,7 @@
           ensure: 'present',
           version_major: '8u202',
           version_minor: 'b08',
-          java: 'jdk'
+          java: 'jdk',
         }
       end
       let(:title) { 'jdk8' }
@@ -306,9 +306,9 @@
           family: 'Windows',
           name: 'Windows',
           release: {
-            full: '8.1'
-          }
-        }
+            full: '8.1',
+          },
+        },
       },
       {
         kernel: 'Darwin',
@@ -316,9 +316,9 @@
           family: 'Darwin',
           name: 'Darwin',
           release: {
-            full: '13.3.0'
-          }
-        }
+            full: '13.3.0',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -326,9 +326,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '7100-02-00-000'
-          }
-        }
+            full: '7100-02-00-000',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -336,9 +336,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '6100-07-04-1216'
-          }
-        }
+            full: '6100-07-04-1216',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -346,9 +346,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '5300-12-01-1016'
-          }
-        }
+            full: '5300-12-01-1016',
+          },
+        },
       },
     ].each do |facts|
       let(:facts) { facts }
diff --git a/spec/defines/adoptium_spec.rb b/spec/defines/adoptium_spec.rb
index 94fb2ca3..cc3bfa9c 100644
--- a/spec/defines/adoptium_spec.rb
+++ b/spec/defines/adoptium_spec.rb
@@ -16,7 +16,7 @@
           version_build: '7',
           basedir: '/usr/java',
           manage_symlink: true,
-          symlink_name: 'java_home'
+          symlink_name: 'java_home',
         }
       end
       let(:title) { 'jdk16_symlink' }
@@ -33,7 +33,7 @@
           version_patch: '2',
           version_build: '7',
           basedir: '/usr/java',
-          symlink_name: 'java_home'
+          symlink_name: 'java_home',
         }
       end
       let(:title) { 'jdk16_nosymlink' }
@@ -50,7 +50,7 @@
           version_patch: '2',
           version_build: '7',
           basedir: '/usr/java',
-          symlink_name: 'java_home'
+          symlink_name: 'java_home',
         }
       end
       let(:title) { 'jdk16' }
@@ -69,7 +69,7 @@
           version_patch: '1',
           version_build: '12',
           basedir: '/usr/java',
-          symlink_name: 'java_home'
+          symlink_name: 'java_home',
         }
       end
       let(:title) { 'jdk17' }
@@ -86,7 +86,7 @@
           version_major: '16',
           version_minor: '0',
           version_patch: '2',
-          version_build: '7'
+          version_build: '7',
         }
       end
       let(:title) { 'jdk16' }
@@ -115,7 +115,7 @@
           version_minor: '0',
           version_patch: '2',
           version_build: '7',
-          basedir: '/usr/java'
+          basedir: '/usr/java',
         }
       end
       let(:title) { 'jdk16' }
@@ -134,7 +134,7 @@
           version_patch: '2',
           version_build: '7',
           basedir: '/usr/java',
-          manage_basedir: true
+          manage_basedir: true,
         }
       end
       let(:title) { 'jdk16' }
@@ -154,7 +154,7 @@
           version_minor: '0',
           version_patch: '2',
           version_build: '7',
-          symlink_name: 'java_home'
+          symlink_name: 'java_home',
         }
       end
       let(:title) { 'jdk16' }
@@ -172,7 +172,7 @@
           version_minor: '0',
           version_patch: '1',
           version_build: '12',
-          symlink_name: 'java_home'
+          symlink_name: 'java_home',
         }
       end
       let(:title) { 'jdk17' }
@@ -189,7 +189,7 @@
           version_major: '16',
           version_minor: '0',
           version_patch: '2',
-          version_build: '7'
+          version_build: '7',
         }
       end
       let(:title) { 'jdk16' }
@@ -218,7 +218,7 @@
           version_minor: '0',
           version_patch: '2',
           version_build: '7',
-          basedir: '/usr/lib/jvm'
+          basedir: '/usr/lib/jvm',
         }
       end
       let(:title) { 'jdk16' }
@@ -237,7 +237,7 @@
           version_patch: '2',
           version_build: '7',
           basedir: '/usr/lib/jvm',
-          manage_basedir: true
+          manage_basedir: true,
         }
       end
       let(:title) { 'jdk16' }
@@ -254,9 +254,9 @@
           family: 'Windows',
           name: 'Windows',
           release: {
-            full: '8.1'
-          }
-        }
+            full: '8.1',
+          },
+        },
       },
       {
         kernel: 'Darwin',
@@ -264,9 +264,9 @@
           family: 'Darwin',
           name: 'Darwin',
           release: {
-            full: '13.3.0'
-          }
-        }
+            full: '13.3.0',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -274,9 +274,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '7100-02-00-000'
-          }
-        }
+            full: '7100-02-00-000',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -284,9 +284,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '6100-07-04-1216'
-          }
-        }
+            full: '6100-07-04-1216',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -294,9 +294,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '5300-12-01-1016'
-          }
-        }
+            full: '5300-12-01-1016',
+          },
+        },
       },
     ].each do |facts|
       let(:facts) { facts }
diff --git a/spec/defines/download_spec.rb b/spec/defines/download_spec.rb
index b7b288bd..fcf254dc 100644
--- a/spec/defines/download_spec.rb
+++ b/spec/defines/download_spec.rb
@@ -15,7 +15,7 @@
           version_major: '8u201',
           version_minor: 'b09',
           java_se: 'jdk',
-          url:
+          url:,
         }
       end
       let(:title) { 'jdk8' }
@@ -31,7 +31,7 @@
           ensure: 'present',
           version_major: '8u201',
           version_minor: 'b09',
-          java_se: 'jdk'
+          java_se: 'jdk',
         }
       end
       let(:title) { 'jdk8' }
@@ -50,7 +50,7 @@
           basedir: '/usr/java',
           manage_symlink: true,
           symlink_name: 'java_home',
-          url:
+          url:,
         }
       end
       let(:title) { 'jdk6' }
@@ -65,7 +65,7 @@
           version: '6',
           java_se: 'jdk',
           basedir: '/usr/java',
-          url:
+          url:,
         }
       end
       let(:title) { 'jdk6_nosymlink' }
@@ -104,9 +104,9 @@
           family: 'Windows',
           name: 'Windows',
           release: {
-            full: '8.1'
-          }
-        }
+            full: '8.1',
+          },
+        },
       },
       {
         kernel: 'Darwin',
@@ -114,9 +114,9 @@
           family: 'Darwin',
           name: 'Darwin',
           release: {
-            full: '13.3.0'
-          }
-        }
+            full: '13.3.0',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -124,9 +124,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '7100-02-00-000'
-          }
-        }
+            full: '7100-02-00-000',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -134,9 +134,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '6100-07-04-1216'
-          }
-        }
+            full: '6100-07-04-1216',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -144,9 +144,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '5300-12-01-1016'
-          }
-        }
+            full: '5300-12-01-1016',
+          },
+        },
       },
     ].each do |facts|
       let(:facts) { facts }
diff --git a/spec/defines/sap_spec.rb b/spec/defines/sap_spec.rb
index 5f4f9945..1634252d 100644
--- a/spec/defines/sap_spec.rb
+++ b/spec/defines/sap_spec.rb
@@ -14,7 +14,7 @@
           java: 'jdk',
           basedir: '/usr/java',
           manage_symlink: true,
-          symlink_name: 'java_home'
+          symlink_name: 'java_home',
         }
       end
       let(:title) { 'jdk11_symlink' }
@@ -76,7 +76,7 @@
         {
           ensure: 'present',
           version_full: '11.0.7',
-          java: 'jdk'
+          java: 'jdk',
         }
       end
       let(:title) { 'jdk1107' }
@@ -101,7 +101,7 @@
           ensure: 'present',
           version: '8',
           java: 'jdk',
-          basedir: '/usr/java'
+          basedir: '/usr/java',
         }
       end
       let(:title) { 'jdk8' }
@@ -116,7 +116,7 @@
           version: '8',
           java: 'jdk',
           basedir: '/usr/java',
-          manage_basedir: true
+          manage_basedir: true,
         }
       end
       let(:title) { 'jdk8' }
@@ -175,7 +175,7 @@
         {
           ensure: 'present',
           version_full: '11.0.7',
-          java: 'jdk'
+          java: 'jdk',
         }
       end
       let(:title) { 'jdk1107' }
@@ -203,9 +203,9 @@
           family: 'Windows',
           name: 'Windows',
           release: {
-            full: '8.1'
-          }
-        }
+            full: '8.1',
+          },
+        },
       },
       {
         kernel: 'Darwin',
@@ -213,9 +213,9 @@
           family: 'Darwin',
           name: 'Darwin',
           release: {
-            full: '13.3.0'
-          }
-        }
+            full: '13.3.0',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -223,9 +223,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '7100-02-00-000'
-          }
-        }
+            full: '7100-02-00-000',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -233,9 +233,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '6100-07-04-1216'
-          }
-        }
+            full: '6100-07-04-1216',
+          },
+        },
       },
       {
         kernel: 'AIX',
@@ -243,9 +243,9 @@
           family: 'AIX',
           name: 'AIX',
           release: {
-            full: '5300-12-01-1016'
-          }
-        }
+            full: '5300-12-01-1016',
+          },
+        },
       },
     ].each do |facts|
       let(:facts) { facts }
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index ae7c1f68..2f7fdae3 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -26,7 +26,7 @@
 
   begin
     require 'deep_merge'
-    default_facts.deep_merge!(YAML.safe_load(File.read(f), permitted_classes: [], permitted_symbols: [], aliases: true))
+    default_facts.deep_merge!(YAML.safe_load_file(f, permitted_classes: [], permitted_symbols: [], aliases: true))
   rescue StandardError => e
     RSpec.configuration.reporter.message "WARNING: Unable to load #{f}: #{e}"
   end