diff --git a/.github/workflows/amphora-image-build.yml b/.github/workflows/amphora-image-build.yml
index bcc67e7e5..2347c688a 100644
--- a/.github/workflows/amphora-image-build.yml
+++ b/.github/workflows/amphora-image-build.yml
@@ -39,17 +39,17 @@ jobs:
     permissions: {}
     steps:
 
-      - name: Install Package
-        uses: ConorMacBride/install-package@main
-        with:
-          apt: git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
+      - name: Install Package dependencies
+        run: |
+          sudo apt update &&
+          sudo apt install -y git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
 
       - name: Start the SSH service
         run: |
           sudo /etc/init.d/ssh start
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
@@ -80,7 +80,7 @@ jobs:
           pip install -r ../src/kayobe-config/requirements.txt
 
       - name: Install terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
 
       - name: Initialise terraform
         run: terraform init
@@ -255,7 +255,7 @@ jobs:
         if: steps.build_amphora.outcome == 'failure'
 
       - name: Upload logs & image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: amphora-image-build-log
           path: ./artifact
diff --git a/.github/workflows/amphora-image-promote.yml b/.github/workflows/amphora-image-promote.yml
index c6efd2e60..ebdce743a 100644
--- a/.github/workflows/amphora-image-promote.yml
+++ b/.github/workflows/amphora-image-promote.yml
@@ -15,7 +15,7 @@ jobs:
     if: github.repository == 'stackhpc/stackhpc-kayobe-config'
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
diff --git a/.github/workflows/ipa-image-build.yml b/.github/workflows/ipa-image-build.yml
index cd770213d..4b298bf12 100644
--- a/.github/workflows/ipa-image-build.yml
+++ b/.github/workflows/ipa-image-build.yml
@@ -51,17 +51,17 @@ jobs:
       - runner-selection
     permissions: {}
     steps:
-      - name: Install Package
-        uses: ConorMacBride/install-package@main
-        with:
-          apt: git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
+      - name: Install Package dependencies
+        run: |
+          sudo apt update &&
+          sudo apt install -y git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
 
       - name: Start the SSH service
         run: |
           sudo /etc/init.d/ssh start
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
@@ -95,7 +95,7 @@ jobs:
           pip install -r ../src/kayobe-config/requirements.txt
 
       - name: Install terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
 
       - name: Initialise terraform
         run: terraform init
@@ -401,7 +401,7 @@ jobs:
         if: always()
 
       - name: Upload logs artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Build logs
           path: ./logs
diff --git a/.github/workflows/ipa-image-promote.yml b/.github/workflows/ipa-image-promote.yml
index 20158c419..cf533f777 100644
--- a/.github/workflows/ipa-image-promote.yml
+++ b/.github/workflows/ipa-image-promote.yml
@@ -34,7 +34,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
diff --git a/.github/workflows/overcloud-host-image-build.yml b/.github/workflows/overcloud-host-image-build.yml
index 1425941d6..7a9891cd7 100644
--- a/.github/workflows/overcloud-host-image-build.yml
+++ b/.github/workflows/overcloud-host-image-build.yml
@@ -57,17 +57,17 @@ jobs:
             exit 1
           fi
 
-      - name: Install Package
-        uses: ConorMacBride/install-package@main
-        with:
-          apt: git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
+      - name: Install Package dependencies
+        run: |
+          sudo apt update &&
+          sudo apt install -y git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq gh
 
       - name: Start the SSH service
         run: |
           sudo /etc/init.d/ssh start
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
@@ -102,7 +102,7 @@ jobs:
           pip install -r ../src/kayobe-config/requirements.txt
 
       - name: Install terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
 
       - name: Initialise terraform
         run: terraform init
@@ -450,7 +450,7 @@ jobs:
             steps.build_ubuntu_noble.outcome == 'failure'
 
       - name: Upload logs artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Build logs
           path: ./logs
diff --git a/.github/workflows/overcloud-host-image-promote.yml b/.github/workflows/overcloud-host-image-promote.yml
index cbc733ee6..2acf1fb48 100644
--- a/.github/workflows/overcloud-host-image-promote.yml
+++ b/.github/workflows/overcloud-host-image-promote.yml
@@ -34,7 +34,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
diff --git a/.github/workflows/overcloud-host-image-upload.yml b/.github/workflows/overcloud-host-image-upload.yml
index ccb286183..65a12f086 100644
--- a/.github/workflows/overcloud-host-image-upload.yml
+++ b/.github/workflows/overcloud-host-image-upload.yml
@@ -64,7 +64,7 @@ jobs:
           sudo apt update
           sudo apt install -y build-essential git unzip nodejs python3-wheel python3-pip python3-venv
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
diff --git a/.github/workflows/package-build-ofed.yml b/.github/workflows/package-build-ofed.yml
index f151337ef..dfb00d9df 100644
--- a/.github/workflows/package-build-ofed.yml
+++ b/.github/workflows/package-build-ofed.yml
@@ -33,17 +33,17 @@ jobs:
         run: |
           echo "ofed_tag=$(date +%Y%m%dT%H%M%S)" >> $GITHUB_OUTPUT
 
-      - name: Install Package
-        uses: ConorMacBride/install-package@main
-        with:
-          apt: git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
+      - name: Install Package dependencies
+        run: |
+          sudo apt update &&
+          sudo apt install -y git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
 
       - name: Start the SSH service
         run: |
           sudo /etc/init.d/ssh start
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
@@ -57,7 +57,7 @@ jobs:
           pip install -r ../src/kayobe-config/requirements.txt
 
       - name: Install terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
 
       - name: Initialise terraform
         run: terraform init
diff --git a/.github/workflows/stackhpc-all-in-one.yml b/.github/workflows/stackhpc-all-in-one.yml
index f7dd65310..3e1332ba8 100644
--- a/.github/workflows/stackhpc-all-in-one.yml
+++ b/.github/workflows/stackhpc-all-in-one.yml
@@ -96,14 +96,14 @@ jobs:
       # NOTE(upgrade): Reference the PREVIOUS release branch here.
       PREVIOUS_BRANCH: stackhpc/2023.1
     steps:
-      - name: Install Package
-        uses: ConorMacBride/install-package@main
-        with:
-          apt: git unzip nodejs openssh-client
+      - name: Install Package dependencies
+        run: |
+          sudo apt update &&
+          sudo apt install -y git unzip nodejs openssh-client
 
       # If testing upgrade, checkout previous release, otherwise checkout current branch
       - name: Checkout ${{ inputs.upgrade && 'previous release' || 'current' }} config
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ inputs.repository }}
           ref: ${{ inputs.upgrade && env.PREVIOUS_BRANCH || inputs.github_ref }}
@@ -139,7 +139,7 @@ jobs:
           fi
 
       - name: Install terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
 
       - name: Initialise terraform
         run: terraform init
@@ -394,7 +394,7 @@ jobs:
         if: inputs.upgrade
 
       - name: Checkout current release config
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ inputs.repository }}
           ref: ${{ inputs.github_ref }}
@@ -500,7 +500,7 @@ jobs:
         if: ${{ !cancelled() && steps.tf_apply.outcome == 'success' }}
 
       - name: Upload test result artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: test-results-${{ inputs.os_distribution }}-${{ inputs.os_release }}-${{ inputs.neutron_plugin }}${{ inputs.upgrade && '-upgrade' || '' }}
           path: |
diff --git a/.github/workflows/stackhpc-build-kayobe-image.yml b/.github/workflows/stackhpc-build-kayobe-image.yml
index 677be9ac8..4704a3feb 100644
--- a/.github/workflows/stackhpc-build-kayobe-image.yml
+++ b/.github/workflows/stackhpc-build-kayobe-image.yml
@@ -51,12 +51,12 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout kayobe config
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: true
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -64,12 +64,12 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
         with:
           driver-opts: |
             image=moby/buildkit:master
@@ -85,7 +85,7 @@ jobs:
       # Setting KAYOBE_USER_UID and KAYOBE_USER_GID to 1001 to match docker's defaults
       # so that docker can run as a privileged user within the Kayobe image.
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           file: ./.automation/docker/kayobe/Dockerfile
           context: .
@@ -100,8 +100,9 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Send message to Slack via Workflow Builder
-        uses: slackapi/slack-github-action@v1.26.0
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
+          webhook-type: "incoming-webhook"
           payload: |
             {
               "channel-id": "${{ env.SLACK_CHANNEL_ID }}",
diff --git a/.github/workflows/stackhpc-check-tags.yml b/.github/workflows/stackhpc-check-tags.yml
index db2383e21..7a5aecfd9 100644
--- a/.github/workflows/stackhpc-check-tags.yml
+++ b/.github/workflows/stackhpc-check-tags.yml
@@ -37,7 +37,7 @@ jobs:
           sudo apt install -y git unzip nodejs
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: true
 
diff --git a/.github/workflows/stackhpc-ci-cleanup.yml b/.github/workflows/stackhpc-ci-cleanup.yml
index e0977f2f5..4a0973127 100644
--- a/.github/workflows/stackhpc-ci-cleanup.yml
+++ b/.github/workflows/stackhpc-ci-cleanup.yml
@@ -17,12 +17,12 @@ jobs:
     environment: ${{ matrix.environment }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 
       - name: Generate clouds.yaml
         run: |
@@ -101,8 +101,9 @@ jobs:
           OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
 
       - name: Send message to Slack via Workflow Builder
-        uses: slackapi/slack-github-action@v1.26.0
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
+          webhook-type: "incoming-webhook"
           payload: |
             {
               "channel-id": "${{ env.SLACK_CHANNEL_ID }}",
diff --git a/.github/workflows/stackhpc-container-image-build.yml b/.github/workflows/stackhpc-container-image-build.yml
index 0d825a2e5..ce2b0063e 100644
--- a/.github/workflows/stackhpc-container-image-build.yml
+++ b/.github/workflows/stackhpc-container-image-build.yml
@@ -81,7 +81,7 @@ jobs:
           fi
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Determine OpenStack release
         id: openstack_release
@@ -153,7 +153,7 @@ jobs:
           sudo apt install -y build-essential git unzip nodejs python3-wheel python3-pip python3-venv curl jq wget
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
@@ -318,7 +318,7 @@ jobs:
         if: inputs.push
 
       - name: Upload output artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: ${{ matrix.distro.name }}-${{ matrix.distro.release }}-${{ matrix.distro.arch }}-logs
           path: image-build-logs
@@ -362,21 +362,21 @@ jobs:
       - runner-selection
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 
       - name: Combine pushed images lists
         run: |
           find . -name 'push-attempt-images.txt' -exec cat {} + > all-pushed-images.txt
 
       - name: Log in to container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ark.stackhpc.com
           username: ${{ secrets.RLS_TRAIN_CI_ARK_REGISTRY_USER }}
           password: ${{ secrets.RLS_TRAIN_CI_ARK_REGISTRY_PASS }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: src/kayobe-config
 
@@ -384,7 +384,7 @@ jobs:
         run: src/kayobe-config/tools/multiarch-manifests.sh
 
       - name: Upload manifest logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: manifest-logs
           path: |
diff --git a/.github/workflows/stackhpc-multinode-periodic.yml b/.github/workflows/stackhpc-multinode-periodic.yml
index ab79407a1..d307c7255 100644
--- a/.github/workflows/stackhpc-multinode-periodic.yml
+++ b/.github/workflows/stackhpc-multinode-periodic.yml
@@ -21,7 +21,7 @@ jobs:
       stackhpc_kayobe_config_previous_version: ${{ steps.generate-inputs.outputs.stackhpc_kayobe_config_previous_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Generate inputs for multinode workflow
         id: generate-inputs
diff --git a/.github/workflows/stackhpc-promote.yml b/.github/workflows/stackhpc-promote.yml
index 10c160021..2c66454a5 100644
--- a/.github/workflows/stackhpc-promote.yml
+++ b/.github/workflows/stackhpc-promote.yml
@@ -45,8 +45,9 @@ jobs:
           echo "::notice Container image promote workflow: https://github.com/stackhpc/stackhpc-release-train/actions/workflows/container-promote.yml"
 
       - name: Send message to Slack via Workflow Builder
-        uses: slackapi/slack-github-action@v1.26.0
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
+          webhook-type: "incoming-webhook"
           payload: |
             {
               "channel-id": "${{ env.SLACK_CHANNEL_ID }}",
diff --git a/.github/workflows/stackhpc-pull-request.yml b/.github/workflows/stackhpc-pull-request.yml
index 681eb6fb3..c330e6d1e 100644
--- a/.github/workflows/stackhpc-pull-request.yml
+++ b/.github/workflows/stackhpc-pull-request.yml
@@ -28,10 +28,10 @@ jobs:
       check-tags: ${{ steps.changes.outputs.check-tags }}
     steps:
       - name: GitHub Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check changed files
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           # Filters are defined in this file.
@@ -53,11 +53,11 @@ jobs:
     if: github.repository == 'stackhpc/stackhpc-kayobe-config'
     steps:
       - name: GitHub Checkout 🛎
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Setup Python ${{ matrix.python-version }} 🐍
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install Tox 📦
@@ -81,10 +81,10 @@ jobs:
     if: github.repository == 'stackhpc/stackhpc-kayobe-config'
     steps:
       - name: GitHub Checkout 🛎
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Python ${{ matrix.python-version }} 🐍
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python }}
 
diff --git a/.github/workflows/stackhpc-update-kolla.yml b/.github/workflows/stackhpc-update-kolla.yml
index fdffb6684..45e926c41 100644
--- a/.github/workflows/stackhpc-update-kolla.yml
+++ b/.github/workflows/stackhpc-update-kolla.yml
@@ -21,7 +21,7 @@ jobs:
             codename: Epoxy
     uses: ./.github/workflows/update-dependencies.yml
     with:
-      openstack_version: ${{ matrix.version }}
+      branch: ${{ matrix.version }}
       openstack_codename: ${{ matrix.codename }}
     permissions:
       contents: write
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 8ae3eb9ca..097d8926c 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -3,92 +3,187 @@ name: Update dependencies
 on:
   workflow_call:
     inputs:
-      openstack_version:
-        description: OpenStack version
+      branch:
+        description: Branch to update. Must exist in all repositories. e.g. stackhpc/2025.1
         type: string
         required: true
       openstack_codename:
-        description: OpenStack codename
+        description: OpenStack codename e.g. Epoxy
+        type: string
+        required: true
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: Branch to update. Must exist in all repositories. e.g. stackhpc/2025.1
+        type: string
+        required: true
+      openstack_codename:
+        description: OpenStack codename e.g. Epoxy
         type: string
         required: true
 
 jobs:
-  propose_github_release_updates:
+  propose-dependency-updates:
     if: github.repository == 'stackhpc/stackhpc-kayobe-config'
-    runs-on: ubuntu-22.04
-    strategy:
-      matrix:
-        include:
-          - key: kolla
-            path: src/kayobe-config/etc/kayobe/stackhpc.yml
-            repository: stackhpc/kolla
-            search_regex: 'stackhpc_kolla_source_version\:.*$'
-            prefix: 'stackhpc_kolla_source_version\: '
-
-          - key: kolla-ansible
-            path: src/kayobe-config/etc/kayobe/stackhpc.yml
-            repository: stackhpc/kolla-ansible
-            search_regex: 'stackhpc_kolla_ansible_source_version\:.*$'
-            prefix: 'stackhpc_kolla_ansible_source_version\: '
-
-          - key: kayobe
-            path: src/kayobe-config/requirements.txt
-            repository: stackhpc/kayobe
-            search_regex: 'kayobe@stackhpc\/.*$'
-            prefix: 'kayobe@'
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
       pull-requests: write
-    name: ${{ matrix.key }}
+    name: Propose dependency updates
+    outputs:
+      kolla-tag: ${{ steps.latest_kolla_tag.outputs.latest_tag || steps.current_kolla_version.outputs.version }}
+      kolla-ansible-tag: ${{ steps.latest_kolla_ansible_tag.outputs.latest_tag || steps.current_kolla_ansible_version.outputs.version }}
+      kayobe-tag: ${{ steps.latest_kayobe_tag.outputs.latest_tag || steps.current_kayobe_version.outputs.version }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Checkout Kayobe-config
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.branch }}
+          path: src/kayobe-config
+
+      - name: Set sanitised branch name
+        id: branch_name
+        run: |
+          sanitised_name=$(echo "update-dependencies-${{ inputs.branch }}" | tr '/' '-')
+          echo "name=${sanitised_name}" >> $GITHUB_OUTPUT
+
+      - name: Set up branch and Git config
+        run: |
+          git checkout -b ${{ steps.branch_name.outputs.name }}
+          git config user.name "stackhpc-ci"
+          git config user.email "22933334+stackhpc-ci@users.noreply.github.com"
+        working-directory: src/kayobe-config
+
+      - name: Initialise PR Body
+        run: |
+          echo "This PR was created automatically to update dependencies for the ${{ inputs.branch }} release." > pr_body.md
+          echo "" >> pr_body.md
+          echo "### Changes" >> pr_body.md
+
+      - name: Checkout Kolla repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ inputs.openstack_version }}
-          path: ${{ github.workspace }}/src/kayobe-config
+          repository: stackhpc/kolla
+          ref: ${{ inputs.branch }}
+          fetch-tags: true
+          path: src/kolla
+
+      - name: Get latest Kolla tag
+        id: latest_kolla_tag
+        run: echo "latest_tag=$(git describe --tags --abbrev=0 --match stackhpc/\*)" >> $GITHUB_OUTPUT
+        working-directory: ${{ github.workspace }}/src/kolla
+
+      - name: Get current Kolla version
+        id: current_kolla_version
+        run: |
+          VERSION=$(awk -F': ' '/stackhpc_kolla_source_version:/ {print $2}' src/kayobe-config/etc/kayobe/stackhpc.yml | xargs)
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
-      - name: Checkout the dependency repo
-        uses: actions/checkout@v4
+      - name: Update and commit Kolla version if needed
+        if: steps.latest_kolla_tag.outputs.latest_tag != steps.current_kolla_version.outputs.version
+        run: |
+          sed -i "s/stackhpc_kolla_source_version\:.*$/stackhpc_kolla_source_version\: $(echo $TAG | sed 's|/|\\/|g')/g" etc/kayobe/stackhpc.yml
+          echo "- **Kolla** bumped from \`${{ steps.current_kolla_version.outputs.version }}\` to \`${{ steps.latest_kolla_tag.outputs.latest_tag }}\`" >> ../../pr_body.md
+          echo "  - Changelog: https://github.com/stackhpc/kolla/releases/tag/${{ steps.latest_kolla_tag.outputs.latest_tag }}" >> ../../pr_body.md
+          git add etc/kayobe/stackhpc.yml
+          git commit -m "(automated) Bump kolla to ${{ steps.latest_kolla_tag.outputs.latest_tag }}"
+        env:
+          TAG: ${{ steps.latest_kolla_tag.outputs.latest_tag }}
+        working-directory: src/kayobe-config
+
+      - name: Checkout Kolla Ansible repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          repository: ${{ matrix.repository }}
-          ref: ${{ inputs.openstack_version }}
+          repository: stackhpc/kolla-ansible
+          ref: ${{ inputs.branch }}
           fetch-tags: true
-          path: ${{ github.workspace }}/src/${{ matrix.key }}
+          path: src/kolla-ansible
 
-      - name: Get latest tag
-        id: latest_tag
+      - name: Get latest Kolla Ansible tag
+        id: latest_kolla_ansible_tag
+        run: echo "latest_tag=$(git describe --tags --abbrev=0 --match stackhpc/\*)" >> $GITHUB_OUTPUT
+        working-directory: ${{ github.workspace }}/src/kolla-ansible
+
+      - name: Get current Kolla Ansible version
+        id: current_kolla_ansible_version
         run: |
-          TAG=$(git describe --tags --abbrev=0 --match stackhpc/\*)
-          echo latest_tag=${TAG} >> $GITHUB_OUTPUT
-        working-directory: ${{ github.workspace }}/src/${{ matrix.key }}
+          VERSION=$(awk -F': ' '/stackhpc_kolla_ansible_source_version:/ {print $2}' src/kayobe-config/etc/kayobe/stackhpc.yml | xargs)
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
-      - name: Update dependency key
+      - name: Update and commit Kolla Ansible version if needed
+        if: steps.latest_kolla_ansible_tag.outputs.latest_tag != steps.current_kolla_ansible_version.outputs.version
         run: |
-          TAG_OVERRIDE=$(echo $TAG | sed 's/\//\\\//g')
-          sed -i "s/$SEARCH/$PREFIX$TAG_OVERRIDE/g" $REQUIREMENTS
+          sed -i "s/stackhpc_kolla_ansible_source_version\:.*$/stackhpc_kolla_ansible_source_version\: $(echo $TAG | sed 's|/|\\/|g')/g" etc/kayobe/stackhpc.yml
+          echo "- **Kolla-Ansible** bumped from \`${{ steps.current_kolla_ansible_version.outputs.version }}\` to \`${{ steps.latest_kolla_ansible_tag.outputs.latest_tag }}\`" >> ../../pr_body.md
+          echo "  - Changelog: https://github.com/stackhpc/kolla-ansible/releases/tag/${{ steps.latest_kolla_ansible_tag.outputs.latest_tag }}" >> ../../pr_body.md
+          git add etc/kayobe/stackhpc.yml
+          git commit -m "(automated) Bump kolla-ansible to ${{ steps.latest_kolla_ansible_tag.outputs.latest_tag }}"
         env:
-          PREFIX: ${{ matrix.prefix }}
-          TAG: ${{ steps.latest_tag.outputs.latest_tag }}
-          REQUIREMENTS: ${{ github.workspace }}/${{ matrix.path }}
-          SEARCH: ${{ matrix.search_regex }}
+          TAG: ${{ steps.latest_kolla_ansible_tag.outputs.latest_tag }}
+        working-directory: src/kayobe-config
 
-      - name: Propose changes via PR if required
-        uses: peter-evans/create-pull-request@v7
+      - name: Checkout Kayobe repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          path: ${{ github.workspace }}/src/kayobe-config
-          commit-message: >-
-            Bump ${{ matrix.key }} to ${{ steps.latest_tag.outputs.latest_tag }}
-          author: stackhpc-ci <22933334+stackhpc-ci@users.noreply.github.com>
-          branch: update-dependency/${{ matrix.key }}/${{ inputs.openstack_version }}
-          delete-branch: true
-          title: >-
-            Bump ${{ matrix.key }} to ${{ steps.latest_tag.outputs.latest_tag }}
-          body: >
-            This PR was created automatically to update ${{ inputs.openstack_version }}
-            ${{ matrix.key }} to ${{ steps.latest_tag.outputs.latest_tag }}.
-
-            GitHub Release Changelog:
-            https://github.com/stackhpc/${{ matrix.key }}/releases/tag/${{ steps.latest_tag.outputs.latest_tag }}
-          labels: |
-            automated
-            ${{ inputs.openstack_codename }}
+          repository: stackhpc/kayobe
+          ref: ${{ inputs.branch }}
+          fetch-tags: true
+          path: src/kayobe
+
+      - name: Get latest Kayobe tag
+        id: latest_kayobe_tag
+        run: echo "latest_tag=$(git describe --tags --abbrev=0 --match stackhpc/\*)" >> $GITHUB_OUTPUT
+        working-directory: ${{ github.workspace }}/src/kayobe
+
+      - name: Get current Kayobe version
+        id: current_kayobe_version
+        run: |
+          VERSION=$(grep 'kayobe@stackhpc/' src/kayobe-config/requirements.txt | sed 's/.*@//' | xargs)
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+      - name: Update and commit Kayobe version if needed
+        if: steps.latest_kayobe_tag.outputs.latest_tag != steps.current_kayobe_version.outputs.version
+        run: |
+          sed -i "s|kayobe@stackhpc/.*$|kayobe@$(echo $TAG | sed 's|/|\\/|g')|g" requirements.txt
+          echo "- **Kayobe** bumped from \`${{ steps.current_kayobe_version.outputs.version }}\` to \`${{ steps.latest_kayobe_tag.outputs.latest_tag }}\`" >> ../../pr_body.md
+          echo "  - Changelog: https://github.com/stackhpc/kayobe/releases/tag/${{ steps.latest_kayobe_tag.outputs.latest_tag }}" >> ../../pr_body.md
+          git add requirements.txt
+          git commit -m "(automated) Bump kayobe to ${{ steps.latest_kayobe_tag.outputs.latest_tag }}"
+        env:
+          TAG: ${{ steps.latest_kayobe_tag.outputs.latest_tag }}
+        working-directory: src/kayobe-config
+
+      - name: Check for new commits
+        id: check_commits
+        run: |
+          count=$(git rev-list --count ${{ inputs.branch }}..HEAD)
+          if [ "$count" -gt 0 ]; then
+            echo "has_commits=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_commits=false" >> $GITHUB_OUTPUT
+          fi
+        working-directory: src/kayobe-config
+
+      - name: Push commits
+        if: steps.check_commits.outputs.has_commits == 'true'
+        run: git push --force origin ${{ steps.branch_name.outputs.name }}
+        working-directory: src/kayobe-config
+
+      - name: Create or Update Pull Request
+        if: steps.check_commits.outputs.has_commits == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        working-directory: src/kayobe-config
+        run: |
+          EXISTING_PR=$(gh pr list --head "${{ steps.branch_name.outputs.name }}" --json number -q '.[0].number')
+          if [ -n "$EXISTING_PR" ]; then
+            gh pr close $EXISTING_PR
+          fi
+          gh pr create \
+            --base "${{ inputs.branch }}" \
+            --head "${{ steps.branch_name.outputs.name }}" \
+            --title "(automated) Bump dependencies for OpenStack ${{ inputs.branch }}" \
+            --body-file ../../pr_body.md \
+            --label "automated" \
+            --label "${{ inputs.openstack_codename }}"
+