diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 317ca465..e815b4d9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,9 +19,12 @@ jobs:
       matrix:
         ruby_version:
           - '3.2'
+          - '4.0'
         include:
           - ruby_version: '3.2'
             puppet_version: '~> 8.0'
+          - ruby_version: '4.0'
+            puppet_version: '~> 9.0'
     name: "spec (ruby ${{ matrix.ruby_version }} | puppet ${{ matrix.puppet_version }})"
     uses: "puppetlabs/cat-github-actions/.github/workflows/gem_ci.yml@main"
     secrets: "inherit"
@@ -33,12 +36,16 @@ jobs:
   acceptance:
     needs: "spec"
     strategy:
+      fail-fast: false
       matrix:
         ruby_version:
           - "3.2"
+          - "4.0"
         include:
           - ruby_version: '3.2'
             puppet_version: '~> 8.0'
+          - ruby_version: '4.0'
+            puppet_version: '~> 9.0'
         runs_on:
           - "windows-latest"
     name: "acceptance (${{ matrix.runs_on}} ruby ${{ matrix.ruby_version }} | puppet ${{ matrix.puppet_version }})"
diff --git a/.github/workflows/custom_acceptance.yml b/.github/workflows/custom_acceptance.yml
index a061e54b..605c868c 100644
--- a/.github/workflows/custom_acceptance.yml
+++ b/.github/workflows/custom_acceptance.yml
@@ -31,6 +31,10 @@ on:
         default: "ubuntu-latest"
         type: "string"
 
+env:
+  PUPPET_FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN || secrets.PUPPET_FORGE_TOKEN_PUBLIC }}
+  BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM: "forge-key:${{ secrets.PUPPET_FORGE_TOKEN || secrets.PUPPET_FORGE_TOKEN_PUBLIC }}"
+
 jobs:
   acceptance:
     name: "acceptance"
@@ -43,7 +47,7 @@ jobs:
 
       - name: "export environment"
         run: |
-          echo "PUPPET_GEM_VERSION=${{ inputs.puppet_version }} >> $GITHUB_ENV"
+          echo "PUPPET_GEM_VERSION=${{ inputs.puppet_version }}" >> $GITHUB_ENV
 
       - name: "setup ruby"
         uses: "ruby/setup-ruby@v1"
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 24c49312..38b3e346 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -12,9 +12,12 @@ jobs:
       matrix:
         ruby_version:
           - '3.2'
+          - '4.0'
         include:
           - ruby_version: '3.2'
             puppet_version: '~> 8.0'
+          - ruby_version: '4.0'
+            puppet_version: '~> 9.0'
     name: "spec (ruby ${{ matrix.ruby_version }} | puppet ${{ matrix.puppet_version }})"
     uses: "puppetlabs/cat-github-actions/.github/workflows/gem_ci.yml@main"
     secrets: "inherit"
@@ -25,12 +28,16 @@ jobs:
   acceptance:
     needs: "spec"
     strategy:
+      fail-fast: false
       matrix:
         ruby_version:
           - "3.2"
+          - "4.0"
         include:
           - ruby_version: '3.2'
             puppet_version: '~> 8.0'
+          - ruby_version: '4.0'
+            puppet_version: '~> 9.0'
         runs_on:
           - "windows-latest"
     name: "acceptance (${{ matrix.runs_on}} ruby ${{ matrix.ruby_version }} | puppet ${{ matrix.puppet_version }})"
diff --git a/Gemfile b/Gemfile
index c82e8924..6abd05cf 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,6 +1,15 @@
-source ENV['GEM_SOURCE'] || 'https://rubygems.org'
+# For puppetcore, set GEM_SOURCE_PUPPETCORE = 'https://rubygems-puppetcore.puppet.com'
+gemsource_default = ENV['GEM_SOURCE'] || 'https://rubygems.org'
+gemsource_puppetcore = if ENV['PUPPET_FORGE_TOKEN'] && !ENV['PUPPET_FORGE_TOKEN'].empty?
+                         'https://rubygems-puppetcore.puppet.com'
+                       else
+                         ENV['GEM_SOURCE_PUPPETCORE'] || gemsource_default
+                       end
+source gemsource_default
 
-def location_for(place_or_version, fake_version = nil)
+gem "rexml", require: false
+
+def location_for(place_or_version, fake_version = nil, opts = {})
   git_url_regex = %r{\A(?<url>(https?|git)[:@][^#]*)(#(?<branch>.*))?}
   file_url_regex = %r{\Afile:\/\/(?<path>.*)}
 
@@ -9,7 +18,7 @@ def location_for(place_or_version, fake_version = nil)
   elsif place_or_version && (file_url = place_or_version.match(file_url_regex))
     ['>= 0', { path: File.expand_path(file_url[:path]), require: false }]
   else
-    [place_or_version, { require: false }]
+    [place_or_version, { require: false }.merge(opts)]
   end
 end
 
@@ -17,10 +26,10 @@ group :development do
   gem "json", '= 2.6.1',                         require: false if Gem::Requirement.create(['>= 3.1.0', '< 3.1.3']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "json", '= 2.6.3',                         require: false if Gem::Requirement.create(['>= 3.2.0', '< 4.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "deep_merge", '~> 1.0',                    require: false
-  gem "voxpupuli-puppet-lint-plugins", '~> 5.0', require: false
-  gem "facterdb", '~> 1.18',                     require: false
+  gem "voxpupuli-puppet-lint-plugins", '~> 7.0', require: false
+  gem "facterdb", '~> 4.0',                      require: false
   gem "metadata-json-lint", '~> 4.0',            require: false
-  gem "rspec-puppet-facts", '~> 3.0',            require: false
+  gem "rspec-puppet-facts", '~> 6.0',            require: false
   gem "dependency_checker", '~> 1.0.0',          require: false
   gem "parallel_tests", '3.13.0',              require: false
   gem "pry", '~> 0.10',                          require: false
@@ -33,10 +42,9 @@ group :development do
 end
 group :development, :release_prep do
   gem "puppet-strings", '~> 4.0',         require: false
-  gem "puppetlabs_spec_helper", '~> 8.0', require: false
+  gem "puppetlabs_spec_helper", '~> 9.0', require: false
 end
 group :system_tests do
-  gem "puppet_litmus", '~> 1.0',   require: false, platforms: [:ruby, :x64_mingw]
   gem "CFPropertyList", '< 3.0.7', require: false, platforms: [:mswin, :mingw, :x64_mingw]
   gem "serverspec", '~> 2.41',     require: false
 end
@@ -47,12 +55,11 @@ hiera_version = ENV['HIERA_GEM_VERSION']
 
 gems = {}
 
-gems['puppet'] = location_for(puppet_version)
+gems['puppet'] = location_for(puppet_version, nil, { source: gemsource_puppetcore })
+gems['facter'] = location_for(facter_version, nil, { source: gemsource_puppetcore })
 
-# If facter or hiera versions have been specified via the environment
-# variables
+# If a hiera version has been specified via the environment variable
 
-gems['facter'] = location_for(facter_version) if facter_version
 gems['hiera'] = location_for(hiera_version) if hiera_version
 
 gems.each do |gem_name, gem_params|
diff --git a/ruby-pwsh.gemspec b/ruby-pwsh.gemspec
index 187b37c4..eac436d1 100644
--- a/ruby-pwsh.gemspec
+++ b/ruby-pwsh.gemspec
@@ -28,6 +28,8 @@ Gem::Specification.new do |spec|
     'spec/**/*',
   ]
 
+  spec.add_dependency 'rexml'
+
   spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
diff --git a/spec/acceptance/dsc/basic.rb b/spec/acceptance/dsc/basic.rb
index 47669175..4843b547 100644
--- a/spec/acceptance/dsc/basic.rb
+++ b/spec/acceptance/dsc/basic.rb
@@ -55,7 +55,19 @@ def execute_reset_command(reset_command)
     end
 
     it 'applies idempotently' do
+      trivial_result = powershell.execute('Write-Output "hello from pwsh"')
+      warn "DEBUG trivial exitcode=#{trivial_result[:exitcode]}"
+      warn "DEBUG trivial stdout=#{trivial_result[:native_stdout]}"
+      warn "DEBUG trivial stderr=#{trivial_result[:native_stderr]}"
+      bundle_check = powershell.execute('bundle exec puppet --version')
+      warn "DEBUG bundle_check exitcode=#{bundle_check[:exitcode]}"
+      warn "DEBUG bundle_check stdout=#{bundle_check[:native_stdout]}"
+      warn "DEBUG bundle_check stderr=#{bundle_check[:native_stderr]}"
+      warn "DEBUG command=#{command}"
       first_run_result = powershell.execute(command)
+      warn "DEBUG exitcode=#{first_run_result[:exitcode]}"
+      warn "DEBUG stdout=#{first_run_result[:native_stdout]}"
+      warn "DEBUG stderr=#{first_run_result[:native_stderr]}"
       expect(first_run_result[:exitcode]).to be(2)
       expect(first_run_result[:native_stdout]).to match(/dsc_installationpolicy changed 'Untrusted' to 'Trusted'/)
       expect(first_run_result[:native_stdout]).to match(/Updating: Finished/)
diff --git a/spec/acceptance/dsc/cim_instances.rb b/spec/acceptance/dsc/cim_instances.rb
index b181898e..99f656dc 100644
--- a/spec/acceptance/dsc/cim_instances.rb
+++ b/spec/acceptance/dsc/cim_instances.rb
@@ -67,7 +67,7 @@ def execute_reset_command(reset_command)
       expect(first_run_result[:exitcode]).to be(2)
       # Access Control Set
       expect(first_run_result[:native_stdout]).to match(/dsc_accesscontrollist: dsc_accesscontrollist changed/)
-      expect(first_run_result[:native_stdout]).to match(%r{dsc_ntfsaccessentry\[{:name=>"Test", :dsc_path=>".+/spec/fixtures/access_control"}\]: Updating: Finished})
+      expect(first_run_result[:native_stdout]).to match(%r{dsc_ntfsaccessentry\[\{:?name(?:=>|: )"Test", :?dsc_path(?:=>|: )".+/spec/fixtures/access_control"\}\]: Updating: Finished})
       expect(first_run_result[:stderr]).not_to match(/Error/)
       expect(first_run_result[:stderr]).not_to match(/Warning: Provider returned data that does not match the Type Schema/)
       expect(first_run_result[:stderr]).not_to match(/Value type mismatch/)
diff --git a/spec/acceptance/dsc/complex.rb b/spec/acceptance/dsc/complex.rb
index 079294d6..81614556 100644
--- a/spec/acceptance/dsc/complex.rb
+++ b/spec/acceptance/dsc/complex.rb
@@ -114,10 +114,10 @@ def execute_reset_command(reset_command)
       expect(first_run_result[:exitcode]).to be(2)
       # The Default Site is stopped
       expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[DefaultSite\]/dsc_state: dsc_state changed 'Started' to 'Stopped'})
-      expect(first_run_result[:native_stdout]).to match(/dsc_xwebsite\[{:name=>"DefaultSite", :dsc_name=>"Default Web Site"}\]: Updating: Finished/)
+      expect(first_run_result[:native_stdout]).to match(/dsc_xwebsite\[\{:?name(?:=>|: )"DefaultSite", :?dsc_name(?:=>|: )"Default Web Site"\}\]: Updating: Finished/)
       # AspNet45 is installed
       expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwindowsfeature\[AspNet45\]/dsc_ensure: dsc_ensure changed 'Absent' to 'Present'})
-      expect(first_run_result[:native_stdout]).to match(/dsc_xwindowsfeature\[{:name=>"AspNet45", :dsc_name=>"Web-Asp-Net45"}\]: Creating: Finished/)
+      expect(first_run_result[:native_stdout]).to match(/dsc_xwindowsfeature\[\{:?name(?:=>|: )"AspNet45", :?dsc_name(?:=>|: )"Web-Asp-Net45"\}\]: Creating: Finished/)
       # Web content folder created
       expect(first_run_result[:native_stdout]).to match(%r{File\[WebContentFolder\]/ensure: created})
       # Web content index created
@@ -128,7 +128,7 @@ def execute_reset_command(reset_command)
       expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_physicalpath: dsc_physicalpath changed.*to '.+fixtures/website'})
       expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_state: dsc_state changed.*to 'Started'})
       expect(first_run_result[:native_stdout]).to match(%r{Dsc_xwebsite\[NewWebsite\]/dsc_serverautostart: dsc_serverautostart changed.*to 'true'})
-      expect(first_run_result[:native_stdout]).to match(/dsc_xwebsite\[{:name=>"NewWebsite", :dsc_name=>"Puppet DSC Site"}\]: Creating: Finished/)
+      expect(first_run_result[:native_stdout]).to match(/dsc_xwebsite\[\{:?name(?:=>|: )"NewWebsite", :?dsc_name(?:=>|: )"Puppet DSC Site"\}\]: Creating: Finished/)
       # Run finished
       expect(first_run_result[:native_stdout]).to match(/Applied catalog/)
       # Second run is idempotent