diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8c32acf9..44674150 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   puppet:
     name: Puppet
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 73be88dc..eacd0b33 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -8,6 +8,10 @@ name: "Pull Request Labeler"
 on:
   pull_request_target: {}
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   labeler:
     permissions:
diff --git a/.github/workflows/prepare_release.yml b/.github/workflows/prepare_release.yml
index 01efa1a8..2e3cc689 100644
--- a/.github/workflows/prepare_release.yml
+++ b/.github/workflows/prepare_release.yml
@@ -11,6 +11,10 @@ on:
         description: 'Module version to be released. Must be a valid semver string without leading v. (1.2.3)'
         required: false
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release_prep:
     uses: 'voxpupuli/gha-puppet/.github/workflows/prepare_release.yml@v3'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3db60fbc..0a8b1b18 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: Release
diff --git a/.msync.yml b/.msync.yml
index 32df814c..af9a220d 100644
--- a/.msync.yml
+++ b/.msync.yml
@@ -2,4 +2,4 @@
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-modulesync_config_version: '9.5.0'
+modulesync_config_version: '10.0.0'
diff --git a/.sync.yml b/.sync.yml
index c266ecde..977e5ee9 100644
--- a/.sync.yml
+++ b/.sync.yml
@@ -7,3 +7,7 @@ spec/spec_helper.rb:
   enabled_lint_checks:
     - parameter_documentation
     - parameter_types
+Gemfile:
+  optional:
+    ':test':
+      - gem: 'mocha'
diff --git a/Gemfile b/Gemfile
index ea079b08..dc90537f 100644
--- a/Gemfile
+++ b/Gemfile
@@ -4,10 +4,9 @@
 source ENV['GEM_SOURCE'] || 'https://rubygems.org'
 
 group :test do
-  gem 'voxpupuli-test', '~> 9.0',   :require => false
-  gem 'coveralls',                  :require => false
-  gem 'simplecov-console',          :require => false
+  gem 'voxpupuli-test', '~> 11.0',  :require => false
   gem 'puppet_metadata', '~> 5.0',  :require => false
+  gem 'mocha',                      :require => false
 end
 
 group :development do
@@ -20,13 +19,11 @@ group :system_tests do
 end
 
 group :release do
-  gem 'voxpupuli-release', '~> 3.0',  :require => false
+  gem 'voxpupuli-release', '~> 4.0',  :require => false
 end
 
 gem 'rake', :require => false
-gem 'facter', ENV['FACTER_GEM_VERSION'], :require => false, :groups => [:test]
 
-puppetversion = ENV['PUPPET_GEM_VERSION'] || [">= 7.24", "< 9"]
-gem 'puppet', puppetversion, :require => false, :groups => [:test]
+gem 'openvox', ENV.fetch('OPENVOX_GEM_VERSION', [">= 7", "< 9"]), :require => false, :groups => [:test]
 
 # vim: syntax=ruby
diff --git a/spec/support/spec/verify_contents.rb b/spec/support/spec/verify_contents.rb
new file mode 100644
index 00000000..99d43fe9
--- /dev/null
+++ b/spec/support/spec/verify_contents.rb
@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+def verify_contents(subject, title, expected_lines)
+  content = subject.resource('file', title).send(:parameters)[:content]
+  expect(content.split("\n") & expected_lines).to match_array expected_lines.uniq
+end