diff --git a/.github/workflows/add_new_issue_to_triage_project.yml b/.github/workflows/add_new_issue_to_triage_project.yml
index 775d16e6..f3c5b845 100644
--- a/.github/workflows/add_new_issue_to_triage_project.yml
+++ b/.github/workflows/add_new_issue_to_triage_project.yml
@@ -1,7 +1,26 @@
+# Add new issues to triage project board (https://github.com/orgs/simp/projects/11)
+# ------------------------------------------------------------------------------
+#
+#             NOTICE: **This file is maintained with puppetsync**
+#
+# This file is updated automatically as part of a puppet module baseline.
+#
+# The next baseline sync will overwrite any local changes to this file!
+#
+# ==============================================================================
+# This pipeline uses the following GitHub Action Secrets:
+#
+#   GitHub Secret variable               Notes
+#   -------------------------------      ---------------------------------------
+#   AUTO_TRIAGE_TOKEN                    Token with appropriate permissions
+#
+# ------------------------------------------------------------------------------
+#
+#
 ---
 name: Add new issues to triage project
 
-on:
+'on':
   issues:
     types:
       - opened
diff --git a/.github/workflows/pr_tests.yml b/.github/workflows/pr_tests.yml
index ca47bd97..3af5a898 100644
--- a/.github/workflows/pr_tests.yml
+++ b/.github/workflows/pr_tests.yml
@@ -11,8 +11,8 @@
 # The testing matrix considers ruby/puppet versions supported by SIMP and PE:
 # ------------------------------------------------------------------------------
 # Release       Puppet   Ruby    EOL
-# PE 2019.8     6.22     2.5     2022-12 (LTS)
-# PE 2021.Y     7.x      2.7     Quarterly updates
+# PE 2021.Y     7.x      2.7     2025-02 (LTS)
+# PE 2023.Y     8.x      3.2     Biannual updates
 #
 # https://puppet.com/docs/pe/latest/component_versions_in_recent_pe_releases.html
 # https://puppet.com/misc/puppet-enterprise-lifecycle
@@ -20,14 +20,14 @@
 #
 # https://docs.github.com/en/actions/reference/events-that-trigger-workflows
 #
-
+---
 name: PR Tests
-on:
+'on':
   pull_request:
     types: [opened, reopened, synchronize]
 
 env:
-  PUPPET_VERSION: '~> 7'
+  PUPPET_VERSION: '~> 8'
 
 jobs:
   puppet-syntax:
@@ -38,7 +38,7 @@ jobs:
       - name: "Install Ruby ${{matrix.puppet.ruby_version}}"
         uses: ruby/setup-ruby@v1  # ruby/setup-ruby@ec106b438a1ff6ff109590de34ddc62c540232e0
         with:
-          ruby-version: 2.7
+          ruby-version: 3.2
           bundler-cache: true
       - run: "bundle exec rake syntax"
 
@@ -50,13 +50,13 @@ jobs:
       - name: "Install Ruby ${{matrix.puppet.ruby_version}}"
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.7
+          ruby-version: 3.2
           bundler-cache: true
       - run: "bundle exec rake lint"
       - run: "bundle exec rake metadata_lint"
 
   ruby-style:
-    if: false # TODO Modules will need: rubocop in Gemfile, .rubocop.yml
+    if: false  # TODO Modules will need: rubocop in Gemfile, .rubocop.yml
     name: 'Ruby Style (experimental)'
     runs-on: ubuntu-latest
     continue-on-error: true
@@ -65,7 +65,7 @@ jobs:
       - name: "Install Ruby ${{matrix.puppet.ruby_version}}"
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.7
+          ruby-version: 3.2
           bundler-cache: true
       - run: |
           bundle show
@@ -76,10 +76,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - name: 'Install Ruby 2.7'
+      - name: 'Install Ruby 3.2'
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.7
+          ruby-version: 3.2
           bundler-cache: true
       - run: bundle exec rake check:dot_underscore
       - run: bundle exec rake check:test_file
@@ -92,7 +92,7 @@ jobs:
       - name: 'Install Ruby ${{matrix.puppet.ruby_version}}'
         uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.7
+          ruby-version: 3.2
           bundler-cache: true
       - name: 'Tags and changelogs'
         run: |
diff --git a/.github/workflows/release_rpms.yml b/.github/workflows/release_rpms.yml
index 450ff7c4..04f1ef57 100644
--- a/.github/workflows/release_rpms.yml
+++ b/.github/workflows/release_rpms.yml
@@ -31,7 +31,7 @@
 ---
 name: 'RELENG: Build + attach RPMs to GitHub Release'
 
-on:
+'on':
   workflow_dispatch:
     inputs:
       release_tag:
@@ -71,10 +71,10 @@ on:
         description: "Dry run (Test-build RPMs)"
         required: false
         default: 'no'
-      #verbose:
-      #  description: 'Verbose RPM builds when "yes"'
-      #  required: false
-      #  default: 'no'
+      # verbose:
+      #   description: 'Verbose RPM builds when "yes"'
+      #   required: false
+      #   default: 'no'
       rebuild_number:
         description: 'If this is an RPM rebuild, put the number of the rebuild here'
         required: false
@@ -255,13 +255,13 @@ jobs:
           simp_core_ref_for_building_rpms: ${{ secrets.SIMP_CORE_REF_FOR_BUILDING_RPMS }}
           simp_builder_docker_image: 'docker.io/simpproject/simp_build_${{ github.event.inputs.build_container_os }}:latest'
           path_to_build: "${{ (github.event.inputs.path_to_build != null && format('{0}/{1}', github.workspace, github.event.inputs.path_to_build)) || github.workspace }}"
-          verbose: 'no'  #${{ github.event.inputs.verbose }}
+          verbose: 'no'  # ${{ github.event.inputs.verbose }}
 
       - name: "Wipe all previous assets from GitHub Release (when clean == 'yes')"
         if: ${{ github.event.inputs.clean == 'yes' && github.event.inputs.dry_run != 'yes' }}
         uses: actions/github-script@v6
         env:
-          release_id:  ${{ steps.release-api.outputs.id }}
+          release_id: ${{ steps.release-api.outputs.id }}
         with:
           github-token: ${{ github.event.inputs.target_repo_token || secrets.GITHUB_TOKEN }}
           script: |
@@ -282,7 +282,7 @@ jobs:
         env:
           rpm_file_paths: ${{ steps.build-and-sign-rpm.outputs.rpm_file_paths }}
           rpm_gpg_file: ${{ steps.build-and-sign-rpm.outputs.rpm_gpg_file }}
-          release_id:  ${{ steps.release-api.outputs.id }}
+          release_id: ${{ steps.release-api.outputs.id }}
           clobber: ${{ github.event.inputs.clobber }}
           clean: ${{ github.event.inputs.clean }}
           dry_run: ${{ github.event.inputs.dry_run }}
diff --git a/.github/workflows/tag_deploy.yml b/.github/workflows/tag_deploy.yml
index 2191ab1e..10a5d1c0 100644
--- a/.github/workflows/tag_deploy.yml
+++ b/.github/workflows/tag_deploy.yml
@@ -30,7 +30,7 @@
 ---
 name: 'Tag: Release to GitHub w/RPMs + Puppet Forge'
 
-on:
+'on':
   push:
     tags:
       # NOTE: These filter patterns aren't actually regexes:
@@ -39,7 +39,7 @@ on:
       - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+'
 
 env:
-  PUPPET_VERSION: '~> 7'
+  PUPPET_VERSION: '~> 8'
 
 jobs:
   releng-checks:
@@ -55,7 +55,7 @@ jobs:
           clean: true
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.7
+          ruby-version: 3.2
           bundler-cache: true
       - run: bundle exec rake pkg:check_version
       - run: bundle exec rake pkg:compare_latest_tag
@@ -67,7 +67,8 @@ jobs:
 
   create-github-release:
     name: Deploy GitHub Release
-    needs: [ releng-checks ]
+    needs:
+      - releng-checks
     if: github.repository_owner == 'simp'
     runs-on: ubuntu-latest
     outputs:
@@ -117,17 +118,18 @@ jobs:
         id: create_release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          IS_PRERELASE: ${{ steps.tag-check.outputs.prerelease }}
+          IS_PRERELEASE: ${{ steps.tag-check.outputs.prerelease }}
         run: |
           echo "${RELEASE_MESSAGE}" > /tmp/.commit-msg.txt
           args=(-F /tmp/.commit-msg.txt)
-          [[ $IS_PRERELASE == yes ]] && args+=(--prerelease)
+          [[ "$IS_PRERELEASE" == yes ]] && args+=(--prerelease)
 
           gh release create ${args[@]} "$TARGET_TAG"
 
   build-and-attach-rpms:
     name: Trigger RPM release
-    needs: [ create-github-release ]
+    needs:
+      - create-github-release
     if: github.repository_owner == 'simp'
     runs-on: ubuntu-latest
     env:
@@ -165,7 +167,8 @@ jobs:
 
   deploy-to-puppet-forge:
     name: 'Deploy PuppetForge Release'
-    needs: [ create-github-release ]
+    needs:
+      - create-github-release
     if: (github.repository_owner == 'simp') && (needs.create-github-release.outputs.prerelease != 'yes')
     runs-on: ubuntu-latest
     env:
@@ -180,7 +183,7 @@ jobs:
           clean: true
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.7
+          ruby-version: 3.2
           bundler-cache: true
       - name: Build Puppet module (PDK)
         run: bundle exec pdk build --force
diff --git a/.github/workflows/validate_tokens.yml b/.github/workflows/validate_tokens.yml
index 11dd5f32..cfbba7bc 100644
--- a/.github/workflows/validate_tokens.yml
+++ b/.github/workflows/validate_tokens.yml
@@ -21,7 +21,7 @@
 ---
 name: 'Manual: Validate API tokens'
 
-on:
+'on':
   - workflow_dispatch
 
 jobs:
@@ -66,4 +66,3 @@ jobs:
             echo "::debug ::${scopes}"
             exit 1
           fi
-
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index baba75f6..bfa224f4 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -8,13 +8,12 @@
 # ------------------------------------------------------------------------------
 # The testing matrix considers ruby/puppet versions supported by SIMP and PE:
 #
-# https://puppet.com/docs/pe/2019.8/component_versions_in_recent_pe_releases.html
+# https://puppet.com/docs/pe/latest/component_versions_in_recent_pe_releases.html
 # https://puppet.com/misc/puppet-enterprise-lifecycle
-# https://puppet.com/docs/pe/2018.1/overview/getting_support_for_pe.html
 # ------------------------------------------------------------------------------
 # Release       Puppet   Ruby    EOL
-# PE 2019.8     6.28     2.5.7   2023-07 (LTS)
-# PE 2021.7     7.20     2.7.6   TBD (LTS)
+# PE 2021.7     7.30     2.7.8   2025-02 (LTS)
+# PE 2023.8     8.6      3.2.3   TBD
 ---
 
 stages:
@@ -31,7 +30,7 @@ variables:
   # anchors.  If it is still `UNDEFINED`, all the other setting from the job's
   # anchor are also missing.
   PUPPET_VERSION:    'UNDEFINED' # <- Matrixed jobs MUST override this (or fail)
-  BUNDLER_VERSION:   '1.17.1'
+  BUNDLER_VERSION:   '2.4.22'
   SIMP_MATRIX_LEVEL: '1'
   SIMP_FORCE_RUN_MATRIX: 'no'
 
@@ -76,7 +75,7 @@ variables:
     # Bundle gems (preferring cached > local > downloaded resources)
     #   * Try to use cached and local resources before downloading dependencies
     - echo -e "\e[0Ksection_start:`date +%s`:before_script30[collapsed=true]\r\e[0KBundle gems (preferring cached > local > downloaded resources)"
-    - 'declare GEM_BUNDLER_VER=(-v "~> ${BUNDLER_VERSION:-2.2.6}")'
+    - 'declare GEM_BUNDLER_VER=(-v "~> ${BUNDLER_VERSION:-2.4.22}")'
     - 'declare GEM_INSTALL_CMD=(gem install --no-document)'
     - 'declare BUNDLER_INSTALL_CMD=(bundle install --no-binstubs --jobs $(nproc) "${FLAGS[@]}")'
     - 'mkdir -p ${GEM_HOME} ${BUNDLER_BIN}'
@@ -368,13 +367,13 @@ pup7.pe-unit_slow:
   <<: *slow_unit_tests
 
 # Commented until we are ready for puppet 8
-#pup8.x-unit:
-#  <<: *pup_8_x
-#  <<: *unit_tests
-#
-#pup8.x-unit_slow:
-#  <<: *pup_8_x
-#  <<: *slow_unit_tests
+pup8.x-unit:
+  <<: *pup_8_x
+  <<: *unit_tests
+
+pup8.x-unit_slow:
+  <<: *pup_8_x
+  <<: *slow_unit_tests
 
 # ------------------------------------------------------------------------------
 #             NOTICE: **This file is maintained with puppetsync**
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 1b21aa4d..f15d24b1 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #
 # ------------------------------------------------------------------------------
 #         NOTICE: **This file is maintained with puppetsync**
@@ -90,7 +91,7 @@ def set_hieradata(hieradata)
   # If nothing else...
   c.default_facts = {
     production: {
-      #:fqdn           => 'production.rspec.test.localdomain',
+      # :fqdn           => 'production.rspec.test.localdomain',
       path: '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin',
       concat_basedir: '/tmp'
     }
@@ -151,9 +152,9 @@ def set_hieradata(hieradata)
 
     # sanitize hieradata
     if defined?(hieradata)
-      set_hieradata(hieradata.gsub(':', '_'))
+      set_hieradata(hieradata.tr(':', '_'))
     elsif defined?(class_name)
-      set_hieradata(class_name.gsub(':', '_'))
+      set_hieradata(class_name.tr(':', '_'))
     end
   end