diff --git a/nova/core/galaxy.yml b/nova/core/galaxy.yml
index 4d524f717..ec0b43c2b 100644
--- a/nova/core/galaxy.yml
+++ b/nova/core/galaxy.yml
@@ -1,6 +1,6 @@
 namespace: nova
 name: core
-version: 11.1.0
+version: 11.3.0
 readme: README.md
 authors:
   - https://github.com/novateams
diff --git a/nova/core/roles/accounts/tasks/create_domain_groups.yml b/nova/core/roles/accounts/tasks/create_domain_groups.yml
deleted file mode 100644
index 3989b44d2..000000000
--- a/nova/core/roles/accounts/tasks/create_domain_groups.yml
+++ /dev/null
@@ -1,41 +0,0 @@
----
-- name: Creating Domain groups...
-  microsoft.ad.group:
-    name: "{{ item.name }}"
-    scope: "{{ item.scope | default(domainlocal) }}"
-    path: "{{ item.ou | default(omit) }}"
-    description: "{{ item.description | default(omit) }}"
-  loop: "{{ domain_groups }}"
-  loop_control:
-    label: "{{ item.name | default('') }}"
-  when: item.members is not defined
-
-- name: Configuring following domain groups and replacing members...
-  microsoft.ad.group:
-    name: "{{ item.name }}"
-    scope: "{{ item.scope | default(domainlocal) }}"
-    path: "{{ item.ou | default(omit) }}"
-    description: "{{ item.description | default(omit) }}"
-    members:
-      set: "{{ item.members }}"
-  loop: "{{ domain_groups }}"
-  loop_control:
-    label: "{{ item.members | default(['no_members']) | join(', ') }} to {{ item.name | default('') }}"
-  when:
-    - item.members is defined
-    - accounts_domain_groups_members_strategy == 'replace'
-
-- name: Configuring following domain groups and adding members...
-  microsoft.ad.group:
-    name: "{{ item.name }}"
-    scope: "{{ item.scope | default(domainlocal) }}"
-    path: "{{ item.ou | default(omit) }}"
-    description: "{{ item.description | default(omit) }}"
-    members:
-      add: "{{ item.members }}"
-  loop: "{{ domain_groups }}"
-  loop_control:
-    label: "{{ item.members | default(['no_members']) | join(', ') }} to {{ item.name | default('') }}"
-  when:
-    - item.members is defined
-    - accounts_domain_groups_members_strategy == 'add'
diff --git a/nova/core/roles/accounts/tasks/macos_create.yml b/nova/core/roles/accounts/tasks/macos_create.yml
index ff1eaf81a..f3fb2fbb4 100644
--- a/nova/core/roles/accounts/tasks/macos_create.yml
+++ b/nova/core/roles/accounts/tasks/macos_create.yml
@@ -1,17 +1,43 @@
 ---
+- name: MISSING OR INCORRECT VARIABLE(S)
+  ansible.builtin.fail:
+    msg: |
+      The **ansible_deployer_password** variable is required and **connection_no_password** variable must be false.
+      MacOS requires a password as secure token to create and edit user accounts.
+  when: ansible_deployer_password | default(false) is ansible.builtin.falsy
+    or connection_no_password | default(false) is ansible.builtin.truthy
+
+# This required so this role can clean up the default cloud users if they are not in the local_accounts_with_password list
+- name: Adding source creation flag for default cloud account...
+  when: lookup('vars', infra_env ~ '_template_username') | default('') not in [admin_account, '']
+  block:
+    - name: Checking if {{ lookup('vars', infra_env ~ '_template_username') | default('') }} user exists...
+      ansible.builtin.raw: |
+        if dscl . -list /Users | grep -q "^{{ lookup('vars', infra_env ~ '_template_username') | default('') }}$"; then
+            echo "User exists"
+        else
+            echo "User does not exist"
+        fi
+      changed_when: false
+      register: template_user
+
+    - name: Adding account creation source flag for {{ lookup('vars', infra_env ~ '_template_username') | default('') }}...
+      ansible.builtin.raw: |
+        echo "This account was created with {{ ansible_role_name
+          }} role" > /Users/{{ lookup('vars', infra_env ~ '_template_username') | default('') }}/.created
+        chown {{ lookup('vars', infra_env ~ '_template_username') | default('')
+          }}:staff /Users/{{ lookup('vars', infra_env ~ '_template_username') | default('') }}/.created
+      changed_when: true
+      when: template_user.stdout.find('User exists') != -1
+
 - name: Configuring following users...
   ansible.builtin.raw: |
     if dscl . -list /Users | grep -q "^{{ item.username }}$"; then
-
-        echo Setting existing {{ item.username }} user password
-        sysadminctl -resetPasswordFor {{ item.username }} -newPassword {{
-        item.password }} -adminUser {{ ansible_user }} "{{ '' if ansible_password is not defined else '-adminPassword ' ~ ansible_password }}"
-
+      sysadminctl -resetPasswordFor {{ item.username }} -newPassword '{{ item.password }}' -adminUser {{ ansible_user }} -adminPassword '{{ ansible_password }}'
     else
-
-        echo Creating new {{ item.username }} account
-        sysadminctl -addUser {{ item.username }} -password {{ item.password }} -admin -shell /bin/zsh
-
+      echo "Creating new {{ item.username }} account"
+      sysadminctl -addUser {{ item.username }} -password {{ item.password }} -admin -shell /bin/zsh
+      sysadminctl -adminUser {{ ansible_user }} -adminPassword {{ ansible_password }} -secureTokenOn {{ item.username }} -password {{ item.password }}
     fi
   changed_when: true
   loop: "{{ admin_accounts_with_password }}"
@@ -48,8 +74,7 @@
 - name: Adding ssh keys for...
   ansible.builtin.raw: |
     line="$( echo {{ item.ssh_key }} )"
-    if [ "{{ admin_account }}" = "{{ item.username }}" ];
-    then
+    if [ "{{ admin_account }}" = "{{ item.username }}" ]; then
         echo "Adding ssh key to root user"
         file=/var/root/.ssh/authorized_keys
         mkdir -p /var/root/.ssh/
@@ -66,3 +91,15 @@
   loop_control:
     label: "{{ item.username }}"
   when: item.ssh_key is defined
+
+- name: Configuring SSHD in cloud environments...
+  when: accounts_configure_ssh_maxauthtries
+  block:
+    # This to avoid errors when someone has more that 6 SSH keys in their agent
+    - name: Setting SSHD MaxAuthTries to {{ accounts_ssh_maxauthtries }}...
+      ansible.builtin.raw: sed -i "" "s/.*MaxAuthTries.*/MaxAuthTries {{ accounts_ssh_maxauthtries }}/g" /etc/ssh/sshd_config
+      changed_when: true
+
+    - name: Restarting SSHD... # noqa: no-handler
+      ansible.builtin.raw: launchctl kickstart -k system/com.openssh.sshd
+      changed_when: true
diff --git a/nova/core/roles/accounts/tasks/macos_remove.yml b/nova/core/roles/accounts/tasks/macos_remove.yml
index acc5cd3c5..16c1983f1 100644
--- a/nova/core/roles/accounts/tasks/macos_remove.yml
+++ b/nova/core/roles/accounts/tasks/macos_remove.yml
@@ -1,10 +1,11 @@
 ---
+# Ignoring symbolic links and only listing user accounts that have a .created file in their home directory, which indicates they were created by this role.
 - name: Listing user accounts created with {{ ansible_role_name }}...
   ansible.builtin.raw: |
-    for profile in /Users/*/; do
-        if [[ -f $profile/.created ]]; then
-            echo $(basename $profile)
-        fi
+    for profile in /Users/*; do
+      if [[ -f "$profile/.created" && ! -L "$profile" ]]; then
+        basename "$profile"
+      fi
     done
   register: home_profiles
   changed_when: false
@@ -21,8 +22,10 @@
   block:
     - name: Removing following accounts...
       ansible.builtin.raw: |
-        dscl . -delete /Users/{{ item }}
-        rm -rf /Users/{{ item }}
+        pkill -9 -u {{ item }}
+        sysadminctl -deleteUser {{ item }}
+        # rm -rf /Users/{{ item }}
+        # dscl . -delete /Users/{{ item }}
       loop: "{{ user_profiles_to_remove }}"
       changed_when: true
 
@@ -37,10 +40,17 @@
           # because the connection is lost before the reboot command completes.
           # To avoid this, we can ignore unreachable hosts after issuing the reboot command.
           ignore_unreachable: true
+          when: not darwin_with_python
+
+        - name: Rebooting
+          ansible.builtin.reboot:
+          when: darwin_with_python
 
     - name: Removing following accounts...
       ansible.builtin.raw: |
-        dscl . -delete /Users/{{ item }}
-        rm -rf /Users/{{ item }}
+        pkill -9 -u {{ item }}
+        sysadminctl -deleteUser {{ item }}
+        # rm -rf /Users/{{ item }}
+        # dscl . -delete /Users/{{ item }}
       loop: "{{ user_profiles_to_remove }}"
       changed_when: true
diff --git a/nova/core/roles/accounts/tasks/windows_create.yml b/nova/core/roles/accounts/tasks/windows_create.yml
index edf690b15..95d646aa4 100644
--- a/nova/core/roles/accounts/tasks/windows_create.yml
+++ b/nova/core/roles/accounts/tasks/windows_create.yml
@@ -54,8 +54,16 @@
     - name: Creating OUs for {{ ad_domain_name | default('') }}...
       ansible.windows.win_shell: "{{ lookup('ansible.builtin.template', 'Create-OUs.ps1') }}"
 
-    - name: Configuring Domain groups...
-      ansible.builtin.include_tasks: create_domain_groups.yml
+    # Creating all domain groups without members first, since some members may not exist yet
+    - name: Creating following Domain groups...
+      microsoft.ad.group:
+        name: "{{ item.name }}"
+        scope: "{{ item.scope | default('domainlocal') }}"
+        path: "{{ item.ou | default(omit) }}"
+        description: "{{ item.description | default(omit) }}"
+      loop: "{{ domain_groups }}"
+      loop_control:
+        label: "{{ item.name | default('') }}"
 
     - name: Creating following domain accounts...
       microsoft.ad.user:
@@ -87,6 +95,38 @@
         win_domain_user.results | selectattr('changed', 'equalto', true) | map(attribute='item.username')
         | list | intersect([ansible_deployer_username]) | length > 0
 
+    # Configuring all domains groups with members now that all domain accounts have been created with replace strategy
+    - name: Configuring following domain groups and replacing members...
+      microsoft.ad.group:
+        name: "{{ item.name }}"
+        scope: "{{ item.scope | default('domainlocal') }}"
+        path: "{{ item.ou | default(omit) }}"
+        description: "{{ item.description | default(omit) }}"
+        members:
+          set: "{{ item.members }}"
+      loop: "{{ domain_groups }}"
+      loop_control:
+        label: "{{ item.members | default(['no_members']) | join(', ') }} to {{ item.name | default('') }}"
+      when:
+        - item.members is defined
+        - accounts_domain_groups_members_strategy == 'replace'
+
+    # Configuring all domains groups with members now that all domain accounts have been created with add strategy
+    - name: Configuring following domain groups and adding members...
+      microsoft.ad.group:
+        name: "{{ item.name }}"
+        scope: "{{ item.scope | default('domainlocal') }}"
+        path: "{{ item.ou | default(omit) }}"
+        description: "{{ item.description | default(omit) }}"
+        members:
+          add: "{{ item.members }}"
+      loop: "{{ domain_groups }}"
+      loop_control:
+        label: "{{ item.members | default(['no_members']) | join(', ') }} to {{ item.name | default('') }}"
+      when:
+        - item.members is defined
+        - accounts_domain_groups_members_strategy == 'add'
+
 # To make sure that we are setting the password for the correct account on non-primary domain controller
 - name: Setting correct password for {{ ansible_deployer_username }}...
   ansible.builtin.set_fact:
@@ -149,22 +189,16 @@
     - item.ssh_key is defined
     - not item.ssh_key_exclusive | default(accounts_exclusive_ssh_key)
 
-- name: Creating administrators_authorized_keys file...
-  ansible.windows.win_file:
-    path: C:\ProgramData\ssh\administrators_authorized_keys
-    state: touch
-
-- name: Adding administrators_authorized_keys public keys for admins...
-  community.windows.win_lineinfile:
-    path: C:\ProgramData\ssh\administrators_authorized_keys
-    line: "{{ item.ssh_key }}"
+# Adding keys to administrators_authorized_keys in case it's used.
+# Careful with this feature since it allows any ssh key under administrators_authorized_keys to be used to login as any user in the Administrators group.
+# This feature needs the following lines to be enabled in sshd_config:
+# Match Group administrators
+#         AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
+- name: Adding admin_accounts ssh public keys to administrators_authorized_keys file...
+  ansible.windows.win_copy:
+    content: "{{ admin_accounts_with_password | selectattr('ssh_key', 'defined') | map(attribute='ssh_key') | list | unique | join('\n')}}"
+    dest: C:\ProgramData\ssh\administrators_authorized_keys
     create: true
-  loop: "{{ admin_accounts_with_password }}"
-  loop_control:
-    label: "{{ item.username }}"
-  when:
-    - item.username == ansible_deployer_username # Because C:\ProgramData\ssh\administrators_authorized_keys supports only one key
-    - item.ssh_key is defined
 
 - name: Configuring SSHD in cloud environments...
   when: accounts_configure_ssh_maxauthtries
diff --git a/nova/core/roles/caddy/defaults/main.yml b/nova/core/roles/caddy/defaults/main.yml
index 749c80d28..39e59ca29 100644
--- a/nova/core/roles/caddy/defaults/main.yml
+++ b/nova/core/roles/caddy/defaults/main.yml
@@ -39,3 +39,4 @@ caddy_certificates_folder: /srv/certs/
 caddy_auto_https: "disable_certs" # https://caddyserver.com/docs/caddyfile/options#auto-https
 caddy_ocsp_stapling: false
 caddy_use_tls: true # Set to false to disable TLS for all servers or add it as a variable per server
+caddy_enable_compression: true # Set to false to disable compression for all servers or add it as a variable per server
diff --git a/nova/core/roles/caddy/templates/Caddyfile_jinja b/nova/core/roles/caddy/templates/Caddyfile_jinja
index 5feaa94ce..c8eb0dde6 100644
--- a/nova/core/roles/caddy/templates/Caddyfile_jinja
+++ b/nova/core/roles/caddy/templates/Caddyfile_jinja
@@ -22,6 +22,9 @@
 		}
 	}
 
+	{% if caddy_enable_compression %}
+	encode
+	{% endif %}
 	request_body {
 		max_size {{ server.caddy_server_request_body_size | default("10MB") }}
 	}
diff --git a/nova/core/roles/configure_networking/tasks/aws/nmcli.yml b/nova/core/roles/configure_networking/tasks/aws/nmcli.yml
new file mode 100644
index 000000000..321acda07
--- /dev/null
+++ b/nova/core/roles/configure_networking/tasks/aws/nmcli.yml
@@ -0,0 +1,89 @@
+---
+- name: Purging existing networking packages...
+  ansible.builtin.package:
+    name:
+      - netplan.io
+      - cloud-init
+    state: absent
+    purge: true
+  become: true
+
+- name: Cleaning up old network configuration files...
+  ansible.builtin.shell: |
+    rm -rf /etc/systemd/network/*
+    rm -rf /etc/netplan/*
+  changed_when: true
+  become: true
+
+- name: Installing NetworkManager package...
+  ansible.builtin.package:
+    name: network-manager
+    state: present
+    update_cache: true
+  become: true
+
+- name: Templating nmcli configuration files...
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "0644"
+    lstrip_blocks: true
+  loop_control:
+    label: "{{ item.src }}"
+  loop:
+    - src: 70-persistent-net.rules
+      dest: /tmp/{{ project_fullname | default('') }}_{{ inventory_hostname }}_70-persistent-net.rules
+    - src: nmcli.sh
+      dest: /tmp/{{ project_fullname | default('') }}_{{ inventory_hostname }}_nmcli.sh
+  become: false
+  delegate_to: localhost
+
+- name: Uploading nmcli configuration files...
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+  loop_control:
+    label: "{{ item.src }}"
+  loop:
+    - src: /tmp/{{ project_fullname | default('') }}_{{ inventory_hostname }}_70-persistent-net.rules
+      dest: /etc/udev/rules.d/70-persistent-net.rules
+      mode: "0644"
+    - src: /tmp/{{ project_fullname | default('') }}_{{ inventory_hostname }}_nmcli.sh
+      dest: /tmp/nmcli.sh
+      mode: "0755"
+  become: true
+
+- name: Running nmcli configuration script...
+  ansible.builtin.command: /tmp/nmcli.sh
+  changed_when: true
+  become: true
+  async: 3600
+  poll: 0
+
+- name: Waiting until SSH is down for {{ custom_vm_name | default(vm_name) }} over {{ connection_address }}...
+  ansible.builtin.wait_for:
+    host: "{{ connection_address }}"
+    port: 22
+    state: stopped
+    timeout: 300
+  become: false
+  delegate_to: localhost
+
+- name: Waiting until SSH is up for {{ custom_vm_name | default(vm_name) }} over {{ connection_address }}...
+  ansible.builtin.wait_for:
+    host: "{{ connection_address }}"
+    port: 22
+    state: started
+    timeout: 300
+  become: false
+  delegate_to: localhost
+# - name: Removing temporary files...
+#   ansible.builtin.file:
+#     path: /var/tmp/nmcli.sh
+#     state: absent
+# - name: Rebooting {{ custom_vm_name | default(vm_name) }} VM...
+#   ansible.builtin.include_role:
+#     name: nova.core.powerstate
+#   vars:
+#     restart: true
diff --git a/nova/core/roles/configure_networking/tasks/aws/windows_cli.yml b/nova/core/roles/configure_networking/tasks/aws/windows_cli.yml
index 99c04baa7..1fa8ec5fc 100644
--- a/nova/core/roles/configure_networking/tasks/aws/windows_cli.yml
+++ b/nova/core/roles/configure_networking/tasks/aws/windows_cli.yml
@@ -1,5 +1,4 @@
 ---
-# This step is not actually very useful for debugging
 - name: Templating network configuration script...
   ansible.builtin.template:
     src: Configure-Network.ps1
diff --git a/nova/core/roles/configure_networking/templates/nmcli.sh b/nova/core/roles/configure_networking/templates/nmcli.sh
index 201508f2b..03e9cc6f7 100644
--- a/nova/core/roles/configure_networking/templates/nmcli.sh
+++ b/nova/core/roles/configure_networking/templates/nmcli.sh
@@ -85,4 +85,6 @@ fi
 {% endif %}
 {% endfor %}
 
-nmcli networking off && nmcli networking on
+{% if infra_env == "aws" %}
+reboot
+{% endif %}
diff --git a/nova/core/roles/configure_package_mirrors/tasks/debian.yml b/nova/core/roles/configure_package_mirrors/tasks/debian.yml
index 70c09d46c..4c8172ffa 100644
--- a/nova/core/roles/configure_package_mirrors/tasks/debian.yml
+++ b/nova/core/roles/configure_package_mirrors/tasks/debian.yml
@@ -12,14 +12,25 @@
     mode: "0644"
   when: not apt_backup_file.stat.exists
 
-- name: Templating custom debian-{{ ansible_facts.distribution_release }}.list to {{ inventory_hostname }}...
+- name: Removing legacy /etc/apt/sources.list file...
+  ansible.builtin.file:
+    path: /etc/apt/sources.list
+    state: absent
+
+- name: Getting {{ inventory_hostname }} architecture...
+  ansible.builtin.command: dpkg --print-architecture
+  changed_when: false
+  register: dpkg_architecture
+
+- name: Templating debian.sources...
   ansible.builtin.template:
-    src: debian-{{ ansible_facts.distribution_release }}.list
-    dest: /etc/apt/sources.list
+    src: debian.sources
+    dest: /etc/apt/sources.list.d/debian.sources
     mode: "0644"
-  register: apt_sources
+  register: repos_changed
 
 - name: Running apt update... # noqa: no-handler
   ansible.builtin.apt:
     update_cache: true
-  when: apt_sources.changed
+  retries: 2
+  when: repos_changed.changed
diff --git a/nova/core/roles/configure_package_mirrors/tasks/kali.yml b/nova/core/roles/configure_package_mirrors/tasks/kali.yml
index 287b75a6d..f5aba1323 100644
--- a/nova/core/roles/configure_package_mirrors/tasks/kali.yml
+++ b/nova/core/roles/configure_package_mirrors/tasks/kali.yml
@@ -20,13 +20,6 @@
         mode: "0644"
       when: not kali_sources_backup.stat.exists
 
-    - name: Templating custom kali.sources to {{ inventory_hostname }}...
-      ansible.builtin.template:
-        src: kali.sources
-        dest: /etc/apt/sources.list.d/kali.sources
-        mode: "0644"
-      register: kali_sources_templated
-
 - name: Configuring sources.list...
   when: not kali_sources.stat.exists
   block:
@@ -43,16 +36,30 @@
         mode: "0644"
       when: not apt_backup_file.stat.exists
 
-    - name: Templating custom kali.list to {{ inventory_hostname }}...
-      ansible.builtin.template:
-        src: kali-sources.list
-        dest: /etc/apt/sources.list
-        mode: "0644"
-      register: list_apt_sources
+- name: Removing legacy /etc/apt/sources.list file...
+  ansible.builtin.file:
+    path: /etc/apt/sources.list
+    state: absent
+
+- name: Getting {{ inventory_hostname }} architecture...
+  ansible.builtin.command: dpkg --print-architecture
+  changed_when: false
+  register: dpkg_architecture
+
+- name: Adding Kali repository...
+  ansible.builtin.deb822_repository:
+    name: kali
+    architectures:
+      - "{{ dpkg_architecture.stdout }}"
+    types: [deb]
+    uris: "{{ package_mirror_kali_uri.general }}"
+    suites: [kali-rolling]
+    components: [main contrib non-free non-free-firmware]
+    signed_by: /usr/share/keyrings/kali-archive-keyring.gpg
+  register: repos_changed
 
 - name: Running apt update... # noqa: no-handler
   ansible.builtin.apt:
     update_cache: true
   retries: 2
-  when: list_apt_sources.changed | default(false)
-    or kali_sources_templated.changed | default(false)
+  when: repos_changed.changed
diff --git a/nova/core/roles/configure_package_mirrors/tasks/main.yml b/nova/core/roles/configure_package_mirrors/tasks/main.yml
index 2678cecf9..727701acb 100644
--- a/nova/core/roles/configure_package_mirrors/tasks/main.yml
+++ b/nova/core/roles/configure_package_mirrors/tasks/main.yml
@@ -1,35 +1,26 @@
 ---
-- name: Not including tasks for Ansible networks OS...
-  when: ansible_network_os is not defined
-  block:
-    - name: Including Windows Chocolatey mirror tasks...
-      ansible.builtin.include_tasks: choco.yml
-      when: ansible_facts.os_family | default('') == "Windows"
-
-    - name: Configuring Debian family sources.list
-      when: ansible_facts.os_family | default('') == "Debian"
-      block:
-        - name: Including Kali mirror tasks...
-          ansible.builtin.include_tasks: kali.yml
-          when:
-            - ansible_facts.distribution | default('') == "Kali"
-            - package_mirror_kali_uri != {}
+- name: Including Windows Chocolatey mirror tasks...
+  ansible.builtin.include_tasks: choco.yml
+  when: ansible_facts.os_family | default('') == "Windows"
 
-        - name: Including Ubuntu mirror tasks...
-          ansible.builtin.include_tasks: ubuntu.yml
-          when:
-            - ansible_facts.distribution | default('') == "Ubuntu"
-            - package_mirror_ubuntu_uri != {}
+- name: Configuring Debian family sources.list
+  when: ansible_facts.os_family | default('') == "Debian"
+  block:
+    - name: Including Kali mirror tasks...
+      ansible.builtin.include_tasks: kali.yml
+      when:
+        - ansible_facts.distribution | default('') == "Kali"
+        - package_mirror_kali_uri != {}
 
-        - name: Including Debian mirror tasks...
-          ansible.builtin.include_tasks: debian.yml
-          when:
-            - ansible_facts.distribution | default('') == "Debian"
-            - customization_method != "proxmox"
-            - package_mirror_debian_uri != {}
+    - name: Including Ubuntu mirror tasks...
+      ansible.builtin.include_tasks: ubuntu.yml
+      when:
+        - ansible_facts.distribution | default('') == "Ubuntu"
+        - package_mirror_ubuntu_uri != {}
 
-        - name: Including Parrot mirror tasks...
-          ansible.builtin.include_tasks: parrot.yml
-          when:
-            - ansible_facts.distribution | default('') == "Parrot"
-            - package_mirror_parrot_uri != {}
+    - name: Including Debian mirror tasks...
+      ansible.builtin.include_tasks: debian.yml
+      when:
+        - ansible_facts.distribution | default('') == "Debian"
+        - customization_method != "proxmox"
+        - package_mirror_debian_uri != {}
diff --git a/nova/core/roles/configure_package_mirrors/tasks/parrot.yml b/nova/core/roles/configure_package_mirrors/tasks/parrot.yml
deleted file mode 100644
index 33ff03498..000000000
--- a/nova/core/roles/configure_package_mirrors/tasks/parrot.yml
+++ /dev/null
@@ -1,43 +0,0 @@
----
-- name: Checking if sources.list backup exists...
-  ansible.builtin.stat:
-    path: /etc/apt/sources.list_backup
-  register: default_apt_backup_file
-
-- name: Backing up existing sources.list...
-  ansible.builtin.copy:
-    src: /etc/apt/sources.list
-    dest: /etc/apt/sources.list_backup
-    remote_src: true
-    mode: "0644"
-  when: not default_apt_backup_file.stat.exists
-
-- name: Checking if parrot.list (second file) backup exists...
-  ansible.builtin.stat:
-    path: /etc/apt/sources.list.d/parrot.list_backup
-  register: apt_backup_file
-
-- name: Backing up existing parrot.list
-  ansible.builtin.copy:
-    src: /etc/apt/sources.list.d/parrot.list
-    dest: /etc/apt/sources.list.d/parrot.list_backup
-    remote_src: true
-    mode: "0644"
-  when: not apt_backup_file.stat.exists
-
-- name: Templating custom parrot-sources.list to {{ inventory_hostname }}...
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-    mode: "0644"
-  register: apt_sources
-  loop:
-    - src: parrot-sources-1.list
-      dest: /etc/apt/sources.list
-    - src: parrot-sources-2.list
-      dest: /etc/apt/sources.list.d/parrot.list
-
-- name: Running apt update...
-  ansible.builtin.apt:
-    update_cache: true
-  when: apt_sources.results[0].changed or apt_sources.results[1].changed
diff --git a/nova/core/roles/configure_package_mirrors/tasks/ubuntu.yml b/nova/core/roles/configure_package_mirrors/tasks/ubuntu.yml
index 5610183d1..2ad4531b2 100644
--- a/nova/core/roles/configure_package_mirrors/tasks/ubuntu.yml
+++ b/nova/core/roles/configure_package_mirrors/tasks/ubuntu.yml
@@ -1,6 +1,11 @@
 ---
-- name: Configuring Ubuntu < 24.04 sources.list
-  when: ansible_facts.distribution_major_version | int < 24
+- name: Checking if ubuntu.sources is used...
+  ansible.builtin.stat:
+    path: /etc/apt/sources.list.d/ubuntu.sources
+  register: ubuntu_sources
+
+- name: Configuring ubuntu.sources...
+  when: not ubuntu_sources.stat.exists
   block:
     - name: Checking if sources.list backup exists...
       ansible.builtin.stat:
@@ -15,15 +20,8 @@
         mode: "0644"
       when: not legacy_apt_backup_file.stat.exists
 
-    - name: Templating custom ubuntu-sources.list to {{ inventory_hostname }}...
-      ansible.builtin.template:
-        src: ubuntu-sources.list
-        dest: /etc/apt/sources.list
-        mode: "0644"
-      register: legacy_apt_sources
-
-- name: Configuring Ubuntu 24.04+ sources.list
-  when: ansible_facts.distribution_major_version | int >= 24
+- name: Configuring ubuntu.sources...
+  when: ubuntu_sources.stat.exists
   block:
     - name: Checking if ubuntu.sources backup exists...
       ansible.builtin.stat:
@@ -38,14 +36,25 @@
         mode: "0644"
       when: not apt_backup_file.stat.exists
 
-    - name: Templating custom ubuntu-sources.list to {{ inventory_hostname }}...
-      ansible.builtin.template:
-        src: ubuntu.sources
-        dest: /etc/apt/sources.list.d/ubuntu.sources
-        mode: "0644"
-      register: apt_sources
+- name: Removing legacy /etc/apt/sources.list file...
+  ansible.builtin.file:
+    path: /etc/apt/sources.list
+    state: absent
+
+- name: Getting {{ inventory_hostname }} architecture...
+  ansible.builtin.command: dpkg --print-architecture
+  changed_when: false
+  register: dpkg_architecture
+
+- name: Templating ubuntu.sources...
+  ansible.builtin.template:
+    src: ubuntu.sources
+    dest: /etc/apt/sources.list.d/ubuntu.sources
+    mode: "0644"
+  register: repos_changed
 
-- name: Running apt update...
+- name: Running apt update... # noqa: no-handler
   ansible.builtin.apt:
     update_cache: true
-  when: legacy_apt_sources.changed | default(false) or apt_sources.changed | default(false)
+  retries: 2
+  when: repos_changed.changed
diff --git a/nova/core/roles/configure_package_mirrors/templates/debian-bookworm.list b/nova/core/roles/configure_package_mirrors/templates/debian-bookworm.list
deleted file mode 100644
index 130f6a875..000000000
--- a/nova/core/roles/configure_package_mirrors/templates/debian-bookworm.list
+++ /dev/null
@@ -1,10 +0,0 @@
-# The original sources.list is backed up as /etc/apt/sources.list_backup
-
-deb {{ package_mirror_debian_uri.general }} {{ ansible_facts.lsb.codename }} main non-free-firmware
-deb-src {{ package_mirror_debian_uri.general }} {{ ansible_facts.lsb.codename }} main non-free-firmware
-
-deb {{ package_mirror_debian_uri.security }} {{ ansible_facts.lsb.codename }}-security main non-free-firmware
-deb-src {{ package_mirror_debian_uri.security }} {{ ansible_facts.lsb.codename }}-security main non-free-firmware
-
-deb {{ package_mirror_debian_uri.updates }} {{ ansible_facts.lsb.codename }}-updates main non-free-firmware
-deb-src {{ package_mirror_debian_uri.updates }} {{ ansible_facts.lsb.codename }}-updates main non-free-firmware
diff --git a/nova/core/roles/configure_package_mirrors/templates/debian-bullseye.list b/nova/core/roles/configure_package_mirrors/templates/debian-bullseye.list
deleted file mode 100644
index f67e14a33..000000000
--- a/nova/core/roles/configure_package_mirrors/templates/debian-bullseye.list
+++ /dev/null
@@ -1,10 +0,0 @@
-# The original sources.list is backed up as /etc/apt/sources.list_backup
-
-deb {{ package_mirror_debian_uri.general }} {{ ansible_facts.lsb.codename }} main
-deb-src {{ package_mirror_debian_uri.general }} {{ ansible_facts.lsb.codename }} main
-
-deb {{ package_mirror_debian_uri.security }} {{ ansible_facts.lsb.codename }}-security main
-deb-src {{ package_mirror_debian_uri.security }} {{ ansible_facts.lsb.codename }}-security main
-
-deb {{ package_mirror_debian_uri.updates }} {{ ansible_facts.lsb.codename }}-updates main
-deb-src {{ package_mirror_debian_uri.updates }} {{ ansible_facts.lsb.codename }}-updates main
diff --git a/nova/core/roles/configure_package_mirrors/templates/debian-trixie.list b/nova/core/roles/configure_package_mirrors/templates/debian-trixie.list
deleted file mode 100644
index 130f6a875..000000000
--- a/nova/core/roles/configure_package_mirrors/templates/debian-trixie.list
+++ /dev/null
@@ -1,10 +0,0 @@
-# The original sources.list is backed up as /etc/apt/sources.list_backup
-
-deb {{ package_mirror_debian_uri.general }} {{ ansible_facts.lsb.codename }} main non-free-firmware
-deb-src {{ package_mirror_debian_uri.general }} {{ ansible_facts.lsb.codename }} main non-free-firmware
-
-deb {{ package_mirror_debian_uri.security }} {{ ansible_facts.lsb.codename }}-security main non-free-firmware
-deb-src {{ package_mirror_debian_uri.security }} {{ ansible_facts.lsb.codename }}-security main non-free-firmware
-
-deb {{ package_mirror_debian_uri.updates }} {{ ansible_facts.lsb.codename }}-updates main non-free-firmware
-deb-src {{ package_mirror_debian_uri.updates }} {{ ansible_facts.lsb.codename }}-updates main non-free-firmware
diff --git a/nova/core/roles/configure_package_mirrors/templates/debian.sources b/nova/core/roles/configure_package_mirrors/templates/debian.sources
new file mode 100644
index 000000000..707971704
--- /dev/null
+++ b/nova/core/roles/configure_package_mirrors/templates/debian.sources
@@ -0,0 +1,37 @@
+# The original debian.sources is backed up as /etc/apt/sources.list_backup
+
+Types: deb
+URIs: {{ package_mirror_debian_uri.general }}
+Suites: {{ ansible_facts.lsb.codename }}
+Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb-src
+URIs: {{ package_mirror_debian_uri.general }}
+Suites: {{ ansible_facts.lsb.codename }}
+Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: {{ package_mirror_debian_uri.security }}
+Suites: {{ ansible_facts.lsb.codename }}-security
+Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb-src
+URIs: {{ package_mirror_debian_uri.security }}
+Suites: {{ ansible_facts.lsb.codename }}-security
+Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: {{ package_mirror_debian_uri.updates }}
+Suites: {{ ansible_facts.lsb.codename }}-updates
+Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb-src
+URIs: {{ package_mirror_debian_uri.updates }}
+Suites: {{ ansible_facts.lsb.codename }}-updates
+Components: main non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
\ No newline at end of file
diff --git a/nova/core/roles/configure_package_mirrors/templates/kali-sources.list b/nova/core/roles/configure_package_mirrors/templates/kali-sources.list
deleted file mode 100644
index 1b3088773..000000000
--- a/nova/core/roles/configure_package_mirrors/templates/kali-sources.list
+++ /dev/null
@@ -1,4 +0,0 @@
-# The original sources.list is backed up as /etc/apt/sources.list_backup
-
-deb {{ package_mirror_kali_uri.general }} kali-rolling main contrib non-free non-free-firmware
-deb-src {{ package_mirror_kali_uri.general }} kali-rolling main contrib non-free non-free-firmware
diff --git a/nova/core/roles/configure_package_mirrors/templates/kali.sources b/nova/core/roles/configure_package_mirrors/templates/kali.sources
deleted file mode 100644
index c86f4cfdf..000000000
--- a/nova/core/roles/configure_package_mirrors/templates/kali.sources
+++ /dev/null
@@ -1,7 +0,0 @@
-# The original kali.sources is backed up as /etc/apt/kali.sources_backup
-
-Types: deb
-URIs: {{ package_mirror_kali_uri.general }}
-Suites: kali-rolling
-Components: main contrib non-free non-free-firmware
-Signed-By: /usr/share/keyrings/kali-archive-keyring.gpg
diff --git a/nova/core/roles/configure_package_mirrors/templates/parrot-sources-1.list b/nova/core/roles/configure_package_mirrors/templates/parrot-sources-1.list
deleted file mode 100644
index 2a2282c53..000000000
--- a/nova/core/roles/configure_package_mirrors/templates/parrot-sources-1.list
+++ /dev/null
@@ -1,3 +0,0 @@
-# The original sources.list is backed up as /etc/apt/sources.list_backup
-
-deb https://{{ nexus_fqdn }}/repository/parrot-lts/ lts main non-free contrib
diff --git a/nova/core/roles/configure_package_mirrors/templates/parrot-sources-2.list b/nova/core/roles/configure_package_mirrors/templates/parrot-sources-2.list
deleted file mode 100644
index 856127b6d..000000000
--- a/nova/core/roles/configure_package_mirrors/templates/parrot-sources-2.list
+++ /dev/null
@@ -1,5 +0,0 @@
-# The original sources.list is backed up as /etc/apt/sources.list.d/parrot.list_backup
-
-deb {{ package_mirror_parrot_uri.general }} parrot main contrib non-free
-deb {{ package_mirror_parrot_uri.security }} parrot-security main contrib non-free
-deb {{ package_mirror_parrot_uri.backports }}  parrot-backports main contrib non-free
diff --git a/nova/core/roles/configure_package_mirrors/templates/ubuntu-sources.list b/nova/core/roles/configure_package_mirrors/templates/ubuntu-sources.list
deleted file mode 100644
index 76b237bf1..000000000
--- a/nova/core/roles/configure_package_mirrors/templates/ubuntu-sources.list
+++ /dev/null
@@ -1,15 +0,0 @@
-# The original sources.list is backed up as {{ '/etc/apt/sources.list_backup' if ansible_facts.distribution_release != 'noble' else '/etc/apt/ubuntu.sources_backup' }}
-
-deb {{ package_mirror_ubuntu_uri.general }} {{ ansible_facts.lsb.codename }} main restricted
-deb {{ package_mirror_ubuntu_uri.general }} {{ ansible_facts.lsb.codename }} universe
-deb {{ package_mirror_ubuntu_uri.general }} {{ ansible_facts.lsb.codename }} multiverse
-
-deb {{ package_mirror_ubuntu_uri.updates }} {{ ansible_facts.lsb.codename }}-updates main restricted
-deb {{ package_mirror_ubuntu_uri.updates }} {{ ansible_facts.lsb.codename }}-updates universe
-deb {{ package_mirror_ubuntu_uri.updates }} {{ ansible_facts.lsb.codename }}-updates multiverse
-
-deb {{ package_mirror_ubuntu_uri.security }} {{ ansible_facts.lsb.codename }}-security main restricted
-deb {{ package_mirror_ubuntu_uri.security }} {{ ansible_facts.lsb.codename }}-security universe
-deb {{ package_mirror_ubuntu_uri.security }} {{ ansible_facts.lsb.codename }}-security multiverse
-
-deb {{ package_mirror_ubuntu_uri.backports }} {{ ansible_facts.lsb.codename }}-backports main restricted universe multiverse
diff --git a/nova/core/roles/gitlab/defaults/main.yml b/nova/core/roles/gitlab/defaults/main.yml
index 0a92e6780..9e43f5be6 100644
--- a/nova/core/roles/gitlab/defaults/main.yml
+++ b/nova/core/roles/gitlab/defaults/main.yml
@@ -1,6 +1,6 @@
 ---
 ### gitlab general
-gitlab_version: 19.1.2-ee.0
+gitlab_version: 19.2.0-ee.0
 gitlab_ssh_port: 10022
 # Increase gitlab ssh MaxAuthTries to avoid connection issues for users with more than 6 keys in their SSH agent set to {} to disable
 gitlab_ssh_max_auth_tries: 20
diff --git a/nova/core/roles/machine_operations/defaults/main.yml b/nova/core/roles/machine_operations/defaults/main.yml
index 158787d7d..08830dab5 100644
--- a/nova/core/roles/machine_operations/defaults/main.yml
+++ b/nova/core/roles/machine_operations/defaults/main.yml
@@ -256,6 +256,9 @@ machine_operations_google_assign_public_ip: true
 
 machine_operations_google_temp_sshd_config_path: /etc/ssh/sshd_config.d/00-{{ infra_env }}-first-run.conf
 
+# The default disk type to use for the VM
+google_cloud_disk_type: pd-ssd
+
 # Will try and pre-create the network for a VM based on the interfaces variable
 # Set to false if network(s) are already pre-created by other means
 machine_operations_google_create_networks: true
@@ -274,3 +277,5 @@ machine_operations_google_firewall_rule:
   name: "{{ item.cloud_id }}-allow-all" # The cloud_id comes from the interfaces list
   allowed:
     - ip_protocol: all
+  source_ranges:
+    - 0.0.0.0/0
diff --git a/nova/core/roles/machine_operations/tasks/aws/create.yml b/nova/core/roles/machine_operations/tasks/aws/create.yml
index fe32c6f4d..85e6a5890 100644
--- a/nova/core/roles/machine_operations/tasks/aws/create.yml
+++ b/nova/core/roles/machine_operations/tasks/aws/create.yml
@@ -150,7 +150,7 @@
 
 - name: Setting connection address to {{ eip_info.public_ip
     | default(created_ec2_instance.instances[0].public_ip_address)
-    | default(existing_instances[-1].public_ip_address) | default('N/A') }}...
+    | default(existing_instances[-1].public_ip_address) | default('N/A') }}
   ansible.builtin.set_fact:
     connection_address: "{{ eip_info.public_ip
       | default(created_ec2_instance.instances[0].public_ip_address)
diff --git a/nova/core/roles/machine_operations/tasks/google/create.yml b/nova/core/roles/machine_operations/tasks/google/create.yml
index a0c6d3e44..8e3975edb 100644
--- a/nova/core/roles/machine_operations/tasks/google/create.yml
+++ b/nova/core/roles/machine_operations/tasks/google/create.yml
@@ -43,7 +43,7 @@
             boot: true
             initialize_params:
               disk_size_gb: "{{ os_disk_size | default(hardware_primary_disk_size) | default(omit) }}"
-              disk_type: "{{ google_cloud_disk_type | default(omit) }}"
+              disk_type: "{{ google_cloud_disk_type }}"
               source_image: "{{ google_cloud_vm_image.path ~ '/' ~ google_image_info.resources[-1].name | default(omit) }}"
         network_interfaces: "{{ omit if not fresh_deploy else lookup('ansible.builtin.template', 'google_cloud_interfaces.yml') | from_yaml }}"
         metadata:
diff --git a/nova/core/roles/machine_operations/tasks/google/create_firewall_rules.yml b/nova/core/roles/machine_operations/tasks/google/create_firewall_rules.yml
index 0aab8fd24..1d30c1ba7 100644
--- a/nova/core/roles/machine_operations/tasks/google/create_firewall_rules.yml
+++ b/nova/core/roles/machine_operations/tasks/google/create_firewall_rules.yml
@@ -3,6 +3,7 @@
   google.cloud.gcp_compute_firewall:
     name: "{{ machine_operations_google_firewall_rule.name }}"
     allowed: "{{ machine_operations_google_firewall_rule.allowed }}"
+    source_ranges: "{{ machine_operations_google_firewall_rule.source_ranges }}"
     network:
       selfLink: "{{ create_network_result.results[loop_index].selfLink }}"
     state: present
diff --git a/nova/core/roles/machine_operations/templates/Configure-CloudWindows.ps1 b/nova/core/roles/machine_operations/templates/Configure-CloudWindows.ps1
index 7a94326e6..3668fb543 100644
--- a/nova/core/roles/machine_operations/templates/Configure-CloudWindows.ps1
+++ b/nova/core/roles/machine_operations/templates/Configure-CloudWindows.ps1
@@ -17,6 +17,7 @@ windows-startup-script-ps1: |
     Start-Transcript -Path $LogPath
 
 {% if infra_env in ["aws", "google"] %}
+    # This is a temporary password for the Administrator user, which will be changed as soon as the accounts role is reached.
     Write-Host "Setting Administrator password"
     $Password = "{{ template_password }}"
     $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force
diff --git a/nova/core/roles/machine_operations/templates/google_cloud_linux_startup_script.yml b/nova/core/roles/machine_operations/templates/google_cloud_linux_startup_script.yml
index 76740bcc1..b93393dfd 100644
--- a/nova/core/roles/machine_operations/templates/google_cloud_linux_startup_script.yml
+++ b/nova/core/roles/machine_operations/templates/google_cloud_linux_startup_script.yml
@@ -8,6 +8,7 @@ startup-script: |
   MaxAuthTries 30
   EOF
   systemctl restart ssh
+  # This is a temporary password for the root user, which will be changed as soon as the accounts role is reached.
   echo root:{{ template_password }} | chpasswd
 
   # Needed during os_configuration role
diff --git a/nova/core/roles/nexus/defaults/main.yml b/nova/core/roles/nexus/defaults/main.yml
index 35193493f..0f363a82d 100644
--- a/nova/core/roles/nexus/defaults/main.yml
+++ b/nova/core/roles/nexus/defaults/main.yml
@@ -9,7 +9,7 @@ nexus_configure_ldap: false # Set to true to also configure LDAP after installat
 nexus_create_repos: false # Set to true to also create default repositories after installation
 nexus_allow_anonymous_access: true # Set to false to disable anonymous access
 nexus_active_encryption_key_id: Primary Encryption Key # Name of the active encryption key that comes with this role
-nexus_version: 3.94.0 # Nexus version to install
+nexus_version: 3.94.1 # Nexus version to install
 
 # Default is the built-in Nexus admin user. If set to a different value than admin, the role will create the user.
 nexus_admin_username: admin
diff --git a/nova/core/roles/os_configuration/tasks/linux_cloud.yml b/nova/core/roles/os_configuration/tasks/linux_cloud.yml
index 2c48ed0de..8d12188be 100644
--- a/nova/core/roles/os_configuration/tasks/linux_cloud.yml
+++ b/nova/core/roles/os_configuration/tasks/linux_cloud.yml
@@ -1,9 +1,10 @@
 ---
-- name: Removing cloud managed hostname...
-  ansible.builtin.replace:
-    dest: /etc/cloud/cloud.cfg
-    regexp: ^ - update_etc_hosts
-    replace: "# - update_etc_hosts"
+# After the initial configuration is done its not needed and will slow down boot in most cases
+- name: Purging cloud-init...
+  ansible.builtin.package:
+    name: cloud-init
+    state: absent
+    purge: true
 
 - name: Installing Gnome for Ubuntu Desktop...
   when: group_names | select('match', '^os_ubuntu_desktop') | list | length > 0
diff --git a/nova/core/roles/outline/defaults/main.yml b/nova/core/roles/outline/defaults/main.yml
index 23f366759..3bfb45bdd 100644
--- a/nova/core/roles/outline/defaults/main.yml
+++ b/nova/core/roles/outline/defaults/main.yml
@@ -1,5 +1,5 @@
 ---
-outline_version: 1.9.1
+outline_version: 1.9.2
 outline_postgres_version: 17 # POSTGRES_VERSION_TAG
 
 # Pre-generated secret key for Outline
diff --git a/nova/core/roles/secrets_to_vault/tasks/check_and_add.yml b/nova/core/roles/secrets_to_vault/tasks/check_and_add.yml
index cc6f901f7..25ce178bf 100644
--- a/nova/core/roles/secrets_to_vault/tasks/check_and_add.yml
+++ b/nova/core/roles/secrets_to_vault/tasks/check_and_add.yml
@@ -38,7 +38,8 @@
           X-Vault-Request: true
           X-Vault-Token: "{{ vault_access_token | default(auth.json.auth.client_token) }}"
           Content-Type: application/merge-patch+json
-        body: "{{ {'data': {account_key_name if sct.username is defined else sct.key:
+        body:
+          "{{ {'data': {account_key_name if sct.username is defined else sct.key:
           (sct.value | default(sct.password) | default(secrets_to_vault_autogenerated_key_secret))}} }}"
         body_format: json
         validate_certs: "{{ validate_vault_certs }}"
@@ -56,7 +57,8 @@
           X-Vault-Request: true
           X-Vault-Token: "{{ vault_access_token | default(auth.json.auth.client_token) }}"
           Content-Type: application/merge-patch+json
-        body: "{{ {'data': {account_key_name if sct.username is defined else sct.key:
+        body:
+          "{{ {'data': {account_key_name if sct.username is defined else sct.key:
           (sct.value | default(sct.password) | default(secrets_to_vault_autogenerated_key_secret))}} }}"
         body_format: json
         validate_certs: "{{ validate_vault_certs }}"
diff --git a/nova/core/roles/template_os_configuration/defaults/main.yml b/nova/core/roles/template_os_configuration/defaults/main.yml
index 1c240c40a..891528e3a 100644
--- a/nova/core/roles/template_os_configuration/defaults/main.yml
+++ b/nova/core/roles/template_os_configuration/defaults/main.yml
@@ -8,6 +8,9 @@ template_os_configuration_update_system: true # Update OS during this role
 template_os_configuration_increase_maxauthtries: true
 template_os_configuration_increase_maxauthtries_value: 20
 
+# Will disable the default Windows SSHD config so that each user can use their own SSH key under $HOME/.ssh/authorized_keys
+template_os_configuration_configure_administrators_authorized_keys: true
+
 # Will create a fresh snapshot after all configuration is done on the template VM
 # Set to false to skip snapshot creation
 template_os_configuration_create_snapshot: true
diff --git a/nova/core/roles/template_os_configuration/tasks/windows.yml b/nova/core/roles/template_os_configuration/tasks/windows.yml
index 9b452a8ee..fb2d88422 100644
--- a/nova/core/roles/template_os_configuration/tasks/windows.yml
+++ b/nova/core/roles/template_os_configuration/tasks/windows.yml
@@ -244,3 +244,4 @@
 
     - regexp: ^.*AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys$
       line: "        #AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys"
+  when: template_os_configuration_configure_administrators_authorized_keys
diff --git a/nova/core/roles/updates/defaults/main.yml b/nova/core/roles/updates/defaults/main.yml
index 8cf7b00eb..29a96cd44 100644
--- a/nova/core/roles/updates/defaults/main.yml
+++ b/nova/core/roles/updates/defaults/main.yml
@@ -15,6 +15,9 @@ debian_family_unattended_upgrades_allow_reboot: false
 # Upgrade method for Debian family
 updates_debian_family_upgrade_method: dist
 
+# Will try and update firmware on Debian family systems if fwupdmgr is installed
+debian_family_updates_firmware: true
+
 ################
 # Linux RedHat #
 ################
@@ -45,3 +48,10 @@ reboot_on_finalize: false
 # This variable can be set to true to always reboot after updates are applied
 # This is required because some updates will stop services like VMTools or QEMU Guest Agent from working properly until the system is rebooted
 updates_freebsd_reboot_after_updates: true
+
+########################
+# pfSense and OPNsense #
+########################
+
+# Whether to do a major and minor version upgrade for OPNsense systems
+updates_opnsense_upgrade: false
diff --git a/nova/core/roles/updates/tasks/debian_family.yml b/nova/core/roles/updates/tasks/debian_family.yml
index 2d9d04759..d98133313 100644
--- a/nova/core/roles/updates/tasks/debian_family.yml
+++ b/nova/core/roles/updates/tasks/debian_family.yml
@@ -12,6 +12,19 @@
   retries: 3
   delay: 3
 
+- name: Updating firmware...
+  ansible.builtin.shell: |
+    if [ -x "$(command -v fwupdmgr)" ]; then
+      fwupdmgr refresh --no-remote-check --assume-yes --force
+      fwupdmgr update --assume-yes --no-reboot-check
+    else
+      echo "fwupdmgr not found, skipping firmware update"
+    fi
+  register: debian_family_firmware_update
+  changed_when: debian_family_firmware_update.stdout is search("Successfully installed firmware")
+  failed_when: debian_family_firmware_update.rc == 1
+  when: debian_family_updates_firmware
+
 - name: Checking if reboot is required...
   ansible.builtin.stat:
     path: /var/run/reboot-required
diff --git a/nova/core/roles/updates/tasks/freebsd.yml b/nova/core/roles/updates/tasks/freebsd.yml
index 45d2b7438..38c4a0fdf 100644
--- a/nova/core/roles/updates/tasks/freebsd.yml
+++ b/nova/core/roles/updates/tasks/freebsd.yml
@@ -6,8 +6,24 @@
     autoremove: true
   register: pkgng_update
 
-- name: Rebooting if required after package updates... # noqa: no-handler
-  ansible.builtin.reboot:
-  when:
-    - pkgng_update.changed
-    - updates_freebsd_reboot_after_updates | bool
+- name: Gathering facts with potentially updated Python version for {{ inventory_hostname }}... # noqa: no-handler
+  when: pkgng_update.changed
+  block:
+    - name: Clearing existing facts for {{ inventory_hostname }}...
+      ansible.builtin.meta: clear_facts
+
+    # The Python might get updated with the previous task
+    - name: Looking up the current Python version...
+      ansible.builtin.raw: python3 --version | awk '{print $2}' | cut -d. -f1,2
+      changed_when: false
+      register: current_python_version
+
+    - name: Re-gathering facts for {{ inventory_hostname }}...
+      ansible.builtin.setup:
+        gather_timeout: 60
+      vars:
+        ansible_python_interpreter: /usr/local/bin/python{{ current_python_version.stdout }}
+
+    - name: Rebooting if required after package updates... # noqa: no-handler
+      ansible.builtin.reboot:
+      when: updates_freebsd_reboot_after_updates | bool
diff --git a/nova/core/roles/updates/tasks/sense.yml b/nova/core/roles/updates/tasks/sense.yml
index e8efec97e..365553f61 100644
--- a/nova/core/roles/updates/tasks/sense.yml
+++ b/nova/core/roles/updates/tasks/sense.yml
@@ -11,7 +11,42 @@
   changed_when: pfsense_update.stdout is search("Installing.*")
   when: ansible_network_os | default('') == "pfsense"
 
-- name: Rebooting...
-  ansible.builtin.reboot:
+- name: Gathering facts with potentially updated Python version for {{ inventory_hostname }}... # noqa: no-handler
+  when: opnsense_update.changed or pfsense_update.changed
+  block:
+    - name: Clearing existing facts for {{ inventory_hostname }}...
+      ansible.builtin.meta: clear_facts
+
+    # The Python might get updated with the previous task
+    - name: Looking up the current Python version...
+      ansible.builtin.raw: python3 --version | awk '{print $2}' | cut -d. -f1,2
+      changed_when: false
+      register: current_python_version
+
+    - name: Re-gathering facts for {{ inventory_hostname }}...
+      ansible.builtin.setup:
+        gather_timeout: 60
+      vars:
+        ansible_python_interpreter: /usr/local/bin/python{{ current_python_version.stdout }}
+
+- name: Upgrading {{ inventory_hostname }}...
+  ansible.builtin.command: opnsense-update -u
+  register: opnsense_upgrade
+  changed_when: opnsense_upgrade.stdout is search("Please reboot.*")
+  failed_when:
+    - opnsense_upgrade.rc != 0
+    - opnsense_upgrade.stdout is not search("No known packages set to fetch was specified.")
+  when:
+    - ansible_network_os | default('') == "opnsense"
+    - updates_opnsense_upgrade
+
+- name: Rebooting and re-including updates tasks...
   when: ("Please reboot." in opnsense_update.stdout_lines | default(''))
+    or ("Please reboot." in opnsense_upgrade.stdout_lines | default(''))
     or ("Please reboot." in pfsense_update.stdout_lines | default(''))
+  block:
+    - name: Rebooting...
+      ansible.builtin.reboot:
+
+    - name: Re-including updates tasks in case there are more updates available...
+      ansible.builtin.include_tasks: sense.yml
diff --git a/nova/core/roles/win_configure_rdp/tasks/disable.yml b/nova/core/roles/win_configure_rdp/tasks/disable.yml
deleted file mode 100644
index 0e3a42060..000000000
--- a/nova/core/roles/win_configure_rdp/tasks/disable.yml
+++ /dev/null
@@ -1,7 +0,0 @@
----
-- name: Disabling RDP...
-  ansible.windows.win_regedit:
-    path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\
-    name: fDenyTSConnections
-    data: 1
-    type: dword
diff --git a/nova/core/roles/win_configure_rdp/tasks/enable.yml b/nova/core/roles/win_configure_rdp/tasks/enable.yml
deleted file mode 100644
index de0504969..000000000
--- a/nova/core/roles/win_configure_rdp/tasks/enable.yml
+++ /dev/null
@@ -1,7 +0,0 @@
----
-- name: Enabling RDP...
-  ansible.windows.win_regedit:
-    path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\
-    name: fDenyTSConnections
-    data: 0
-    type: dword
diff --git a/nova/core/roles/win_configure_rdp/tasks/main.yml b/nova/core/roles/win_configure_rdp/tasks/main.yml
index 09a44a4de..1205907b6 100644
--- a/nova/core/roles/win_configure_rdp/tasks/main.yml
+++ b/nova/core/roles/win_configure_rdp/tasks/main.yml
@@ -1,19 +1,29 @@
 ---
-- name: Including enable RDP task...
-  include_tasks: enable.yml
+- name: Enabling RDP...
   when: configuration == 'enable'
+  block:
+    - name: Enabling RDP from registry...
+      ansible.windows.win_regedit:
+        path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\
+        name: fDenyTSConnections
+        data: 0
+        type: dword
 
-- name: Including disable RDP task...
-  include_tasks: disable.yml
-  when: configuration == 'disable'
+    - name: Enabling Windows Firewall rules for RDP...
+      community.windows.win_firewall_rule:
+        name: "{{ item }}"
+        enabled: true
+      loop:
+        - Remote Desktop - Shadow (TCP-In)
+        - Remote Desktop - User Mode (TCP-In)
+        - Remote Desktop - User Mode (UDP-In)
+        - Remote Desktop - (TCP-WS-In)
+        - Remote Desktop - (TCP-WSS-In)
 
-- name: Enabling Windows Firewall rules for RDP...
-  community.windows.win_firewall_rule:
-    name: "{{ item }}"
-    enabled: yes
-  loop:
-    - Remote Desktop - Shadow (TCP-In)
-    - Remote Desktop - User Mode (TCP-In)
-    - Remote Desktop - User Mode (UDP-In)
-    - Remote Desktop - (TCP-WS-In)
-    - Remote Desktop - (TCP-WSS-In)
+- name: Disabling RDP...
+  ansible.windows.win_regedit:
+    path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\
+    name: fDenyTSConnections
+    data: 1
+    type: dword
+  when: configuration == 'disable'