diff --git a/.github/workflows/typos.yaml b/.github/workflows/typos.yaml
new file mode 100644
index 0000000..43c1bef
--- /dev/null
+++ b/.github/workflows/typos.yaml
@@ -0,0 +1,14 @@
+name: Test Typos
+on: [pull_request]
+permissions: {}
+jobs:
+  run:
+    name: Spell Check with Typos
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Actions Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Check spelling of file.txt
+        uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
diff --git a/.github/workflows/updatecli.yaml b/.github/workflows/updatecli.yaml
index eeced5e..ff0ae11 100644
--- a/.github/workflows/updatecli.yaml
+++ b/.github/workflows/updatecli.yaml
@@ -1,42 +1,27 @@
 ---
-name: updatecli
-
+name: Updatecli
 on:
+  release:
   workflow_dispatch:
-  push:
-  pull_request:
   schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Run every hour
-    - cron: '0 * * * *'
-
+    # Run at 12:00 every Saterday every 14 days
+    - cron: "0 4 * * *"
 jobs:
   updatecli:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Diff
-        uses: updatecli/updatecli-action@v1.19.0
+      - name: "Checkout"
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
+      - name: "Setup updatecli"
+        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
         with:
-          command: diff
-          flags: "--config ./updatecli/updatecli.d"
+          version: "v0.122.1"
+      - name: "Run updatecli"
+        run: updatecli compose apply --clean-git-branches=true --experimental
         env:
-          UPDATECLI_GITHUB_ACTOR: ${{ github.actor }}
-          UPDATECLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: tibdex/github-app-token@v1.5
-        id: generate_token
-        if: github.ref == 'refs/heads/main'
-        with:
-          app_id: ${{ secrets.UPDATECLIBOT_APP_ID }}
-          private_key: ${{ secrets.UPDATECLIBOT_APP_PRIVKEY }}
-      - name: Apply
-        uses: updatecli/updatecli-action@v1.19.0
-        if: github.ref == 'refs/heads/main'
-        with:
-          command: apply
-          flags: "--config ./updatecli/updatecli.d"
-        env:
-          UPDATECLI_GITHUB_ACTOR: ${{ secrets.UPDATECLI_BOT_GITHUB_ACTOR }}
-          UPDATECLI_GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          UPDATECLI_GITHUB_APP_CLIENT_ID: ${{ secrets.UPDATECLIBOT_APP_ID }}
+          UPDATECLI_GITHUB_APP_PRIVATE_KEY: ${{ secrets.UPDATECLIBOT_APP_PRIVKEY }}
+          UPDATECLI_GITHUB_APP_INSTALLATION_ID: ${{ secrets.UPDATECLIBOT_APP_INSTALLATION_ID }}
+          UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
+          UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
+          UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}
diff --git a/.github/workflows/updatecli_test.yaml b/.github/workflows/updatecli_test.yaml
new file mode 100644
index 0000000..e63af5c
--- /dev/null
+++ b/.github/workflows/updatecli_test.yaml
@@ -0,0 +1,22 @@
+---
+name: Updatecli Test
+on:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  updatecli:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
+      - name: "Setup updatecli"
+        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
+        with:
+          version: "v0.122.1"
+      - name: "Test updatecli in dry-run mode"
+        run: "updatecli compose diff"
+        env:
+          # This step is executed in untrusted context. We use a GitHub token with minimal permissions.
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/updatecli_update.yaml b/.github/workflows/updatecli_update.yaml
new file mode 100644
index 0000000..0225c62
--- /dev/null
+++ b/.github/workflows/updatecli_update.yaml
@@ -0,0 +1,26 @@
+---
+name: Updatecli - Update
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+jobs:
+  updatecli:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
+      - name: "Setup updatecli"
+        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
+        with:
+          version: "v0.122.1"
+      - name: "Run updatecli only on existing pipelines"
+        run: updatecli compose apply --clean-git-branches=true --existing-only=true --experimental
+        env:
+          UPDATECLI_GITHUB_APP_CLIENT_ID: ${{ secrets.UPDATECLIBOT_APP_ID }}
+          UPDATECLI_GITHUB_APP_PRIVATE_KEY: ${{ secrets.UPDATECLIBOT_APP_PRIVKEY }}
+          UPDATECLI_GITHUB_APP_INSTALLATION_ID: ${{ secrets.UPDATECLIBOT_APP_INSTALLATION_ID }}
+          UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
+          UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
+          UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
new file mode 100644
index 0000000..a35b633
--- /dev/null
+++ b/.github/workflows/zizmor.yaml
@@ -0,0 +1,23 @@
+name: "GitHub Actions Security Analysis with zizmor \U0001F308"
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+permissions: {}
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: "Run zizmor \U0001F308"
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          # intentionally not scanning the entire repository,
+          inputs: ./.github/
+          advanced-security: true
diff --git a/.github/zizmor.yaml b/.github/zizmor.yaml
new file mode 100644
index 0000000..b8d3aef
--- /dev/null
+++ b/.github/zizmor.yaml
@@ -0,0 +1,4 @@
+
+rules:
+    secrets-outside-env:
+        disable: true
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..0c0c744
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+contact@updatecli.io.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.
diff --git a/FUNDING.yml b/FUNDING.yml
index 34a0e27..74264f9 100644
--- a/FUNDING.yml
+++ b/FUNDING.yml
@@ -1,6 +1,6 @@
 # How to configure this file
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository#about-funding-files
 
-github: [olblak, dduportal]
+github: [updatecli]
 open_collective: updatecli
 liberapay: updatecli
diff --git a/profile/README.md b/profile/README.md
index 8f46e79..efe47ff 100644
--- a/profile/README.md
+++ b/profile/README.md
@@ -15,7 +15,7 @@ This is a community-oriented project, all contributions are greatly appreciated.
 
 Here is a non-exhaustive list of contributions:
 
-* ⭐️ our main GitHub repository [updatecli/updatecli](https://github.com/updatecli/updatecli/stargazers)
+* ⭐️ our main GitHub repository [updatecli/updatecli](https://github.com/updatecli/updatecli/)
 * Propose a new feature request on any of [updatecli](https://github.com/updatecli/) repositories.
 * Highlight an existing feature request with ":thumbsup:" on any of the [updatecli](https://github.com/updatecli/) repositories.
 * Contribute to any repository in the [updatecli](https://github.com/updatecli/) organization
diff --git a/updatecli-compose.yaml b/updatecli-compose.yaml
new file mode 100644
index 0000000..2410d15
--- /dev/null
+++ b/updatecli-compose.yaml
@@ -0,0 +1,33 @@
+---
+policies:
+  - name: Sync AGPL license
+    id: agpl
+    policy: ghcr.io/updatecli/policies/file:0.3.4@sha256:52562d8f76f8148ac82146ebed48ad75c85408537a6187543179201a65ab7db5
+    values:
+      - updatecli/values.d/license/agpl.yaml
+
+  - name: Sync Apache license
+    id: apache
+    policy: ghcr.io/updatecli/policies/file:0.3.4@sha256:52562d8f76f8148ac82146ebed48ad75c85408537a6187543179201a65ab7db5
+    values:
+      - updatecli/values.d/license/apache2.yaml
+
+  - name: Update Updatecli policies
+    id: policy
+    policy: ghcr.io/updatecli/policies/updatecli/autodiscovery:0.8.1@sha256:f8edda1a6cbf0d7274e2b847ede29fc4dc70dd5302ccb8575ae21b069cc0d8a0
+    values:
+      - updatecli/values.d/scm.yaml
+
+  - name: Update githubactions
+    id: gha
+    policy: ghcr.io/updatecli/policies/autodiscovery/githubaction:0.4.1@sha256:869b676074f9fee7edd5d488140a12c3b09a5f8a175f12f26ea85a4f8bd0a9d1
+    values:
+      - updatecli/values.d/scm.yaml
+      - updatecli/values.d/githubaction.yaml
+
+  - name: Handle Updatecli version in GitHub action
+    id: updatecli
+    policy: ghcr.io/updatecli/policies/updatecli/githubaction:0.9.1@sha256:49c07d724474ff7976f7ad5ecb0db9aa46448b456d08f82717913b403a0f02d8
+    values:
+      - updatecli/values.d/scm.yaml
+      - updatecli/values.d/updatecli_gha.yaml
diff --git a/updatecli/updatecli.d/updatecli.yaml b/updatecli/updatecli.d/updatecli.yaml
deleted file mode 100644
index 102b5e7..0000000
--- a/updatecli/updatecli.d/updatecli.yaml
+++ /dev/null
@@ -1,46 +0,0 @@
-title: Bump udpatecli version
-
-scms:
-  default:
-    kind: github
-    spec:
-      user: updatecli
-      email: me@olblak.com
-      owner: updatecli
-      repository: updatecli
-      token: '{{ requiredEnv "UPDATECLI_GITHUB_TOKEN" }}'
-      username: '{{ requiredEnv "UPDATECLI_GITHUB_ACTOR" }}'
-      branch: main
-
-sources:
-  latestVersion:
-    name: Get latest updatecli release
-    kind: githubRelease
-    spec:
-      owner: updatecli
-      repository: updatecli
-      token: '{{ requiredEnv "UPDATECLI_GITHUB_TOKEN" }}'
-      username: '{{ requiredEnv "UPDATECLI_GITHUB_ACTOR" }}'
-
-targets:
-  bugReport:
-    name: '[bug-report] Update updatecli version to {{ source "latestVersion" }}'
-    kind: file
-    spec:
-      file: .github/ISSUE_TEMPLATE/1-bug-report.yml
-      matchPattern: '\*\*updatecli\*\*: .*'
-      content: '**updatecli**: {{ source `latestVersion` }}'
-    scmID: default
-
-pullrequests:
-  default:
-    title: '[updatecli] Bump updatecli version to {{ source "latestVersion" }}'
-    kind: github
-    scmID: default
-    targets:
-      - bugReport
-    spec:
-      automerge: true
-      labels:
-        - chore
-        - skip-changelog
diff --git a/updatecli/values.d/githubaction.yaml b/updatecli/values.d/githubaction.yaml
new file mode 100644
index 0000000..61bff3a
--- /dev/null
+++ b/updatecli/values.d/githubaction.yaml
@@ -0,0 +1,2 @@
+spec:
+  digest: true
diff --git a/updatecli/values.d/license/agpl.yaml b/updatecli/values.d/license/agpl.yaml
new file mode 100644
index 0000000..caf1b19
--- /dev/null
+++ b/updatecli/values.d/license/agpl.yaml
@@ -0,0 +1,25 @@
+title: "Updatecli AGPL License"
+src:
+  url: "https://github.com/updatecli/udash.git"
+  branch: "main"
+
+files:
+  - src: LICENSE
+    dst: LICENSE
+
+pr:
+  automerge: false
+  title: "chore: update AGPL License"
+
+scm:
+  enabled: true
+  kind: githubsearch
+  search: |
+    repo:updatecli/udash
+    repo:updatecli/udash-front
+  branch: "^main$|^master$"
+  commitusingapi: true
+  user: updateclibot
+  limit: 0
+
+automerge: false
diff --git a/updatecli/values.d/license/apache2.yaml b/updatecli/values.d/license/apache2.yaml
new file mode 100644
index 0000000..2c2a60c
--- /dev/null
+++ b/updatecli/values.d/license/apache2.yaml
@@ -0,0 +1,35 @@
+title: Update Apache 2 License
+
+src:
+  url: "https://github.com/updatecli/updatecli.git"
+  branch: "main"
+
+files:
+  - src: LICENSE
+    dst: LICENSE
+
+pr:
+  title: Update Apache 2 License
+  automerge: false
+
+scm:
+  enabled: true
+  kind: githubsearch
+  search: |
+    repo:updatecli/updatecli-action
+    repo:updatecli/updatecli
+    repo:updatecli/asdf-updatecli
+    repo:updatecli/releasepost-action
+    repo:updatecli/releasepost
+    repo:updatecli/plugins
+    repo:updatecli/policies
+    repo:updatecli/demo-terminal
+    repo:updatecli/website
+    repo:updatecli/homebrew-updatecli
+    repo:updatecli/charts
+    repo:updatecli/kubernetes-management
+
+  branch: "^main$|^master$"
+  commitusingapi: true
+  user: updateclibot
+  limit: 0
diff --git a/updatecli/values.d/scm.yaml b/updatecli/values.d/scm.yaml
new file mode 100644
index 0000000..fb21bad
--- /dev/null
+++ b/updatecli/values.d/scm.yaml
@@ -0,0 +1,8 @@
+scm:
+  enabled: true
+  user: updatecli
+  email: bot@updatecli.io
+  owner: updatecli
+  repository: .github
+  username: "updateclibot"
+  branch: main
diff --git a/updatecli/values.d/scm_githubsearch.yaml b/updatecli/values.d/scm_githubsearch.yaml
new file mode 100644
index 0000000..89d1e9b
--- /dev/null
+++ b/updatecli/values.d/scm_githubsearch.yaml
@@ -0,0 +1,10 @@
+scm:
+  enabled: true
+  kind: githubsearch
+  search: "org:updatecli archived:false is:public"
+  branch: "^main$|^master$"
+  commitusingapi: true
+  user: updateclibot
+  limit: 0
+
+automerge: false
diff --git a/updatecli/values.d/updatecli_gha.yaml b/updatecli/values.d/updatecli_gha.yaml
new file mode 100644
index 0000000..b5d24c3
--- /dev/null
+++ b/updatecli/values.d/updatecli_gha.yaml
@@ -0,0 +1 @@
+versionpattern: ">0.0.0-rc.1"