diff --git a/.dockerignore b/.dockerignore
index 02258b40..18ae4566 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,6 +3,7 @@
 
 # Include
 !Dockerfile
+!Dockerfile.azure
 !LICENSE
 !README.md
 !alpine-packages.txt
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 65a3034e..fa14415b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,7 +5,7 @@ updates:
     target-branch: master
     schedule:
       interval: weekly
-      day: monday
+      day: wednesday
       time: "05:00"
       timezone: "UTC"
     assignees:
@@ -20,7 +20,7 @@ updates:
     target-branch: master
     schedule:
       interval: weekly
-      day: monday
+      day: wednesday
       time: "05:00"
       timezone: "UTC"
     assignees:
@@ -35,7 +35,7 @@ updates:
     target-branch: master
     schedule:
       interval: weekly
-      day: monday
+      day: wednesday
       time: "05:00"
       timezone: "UTC"
     assignees:
@@ -58,7 +58,7 @@ updates:
     target-branch: master
     schedule:
       interval: weekly
-      day: monday
+      day: wednesday
       time: "05:00"
       timezone: "UTC"
     assignees:
diff --git a/.github/workflows/auto-pull-request-create.yml b/.github/workflows/auto-pull-request-create.yml
index 52c79dcf..c6b3aa95 100644
--- a/.github/workflows/auto-pull-request-create.yml
+++ b/.github/workflows/auto-pull-request-create.yml
@@ -61,11 +61,11 @@ jobs:
 
   build-and-push:
     name: Build and push
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04-arm
     timeout-minutes: 90
     needs: [pull-request, lint]
     env:
-      VERSION_PREFIX: test-
+      VERSION_SUFFIX: -test
     strategy:
       fail-fast: false
       matrix:
@@ -111,7 +111,7 @@ jobs:
           SOPS_VERSION=$(sed -nE 's/^ARG SOPS_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
           AWS_VERSION=$(sed -nE 's/^aws-cli~=([0-9]+\.[0-9]+)$/\1/p' alpine-packages-aws.txt | head -1)
           GCP_VERSION=$(sed -nE 's/^ARG GCP_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
-          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
+          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile.azure | head -1)
           {
             echo "TF_VERSION=${TF_VERSION}"
             echo "OT_VERSION=${OT_VERSION}"
@@ -146,35 +146,35 @@ jobs:
             done
           }
           sleep 5
-          pull_with_retry "${GHCR_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}"
-          pull_with_retry "${GHCR_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}"
-          pull_with_retry "${DOCKER_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}"
-          pull_with_retry "${DOCKER_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}"
+          pull_with_retry "${GHCR_IMAGE}:${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}${{ env.VERSION_SUFFIX }}"
+          pull_with_retry "${GHCR_IMAGE}:${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}${{ env.VERSION_SUFFIX }}"
+          pull_with_retry "${DOCKER_IMAGE}:${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}${{ env.VERSION_SUFFIX }}"
+          pull_with_retry "${DOCKER_IMAGE}:${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}${{ env.VERSION_SUFFIX }}"
 
       - name: Cont.Struc.Test - ${{ matrix.flavor }} (TF image)
         uses: devops-infra/action-container-structure-test@v1
         with:
           image: >-
-            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}
+            devopsinfra/docker-terragrunt:${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}${{ env.VERSION_SUFFIX }}
           config: tests/${{ matrix.flavor }}.yml
 
       - name: Cont.Struc.Test - ${{ matrix.flavor }} (OT image)
         uses: devops-infra/action-container-structure-test@v1
         with:
           image: >-
-            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}
+            devopsinfra/docker-terragrunt:${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}${{ env.VERSION_SUFFIX }}
           config: tests/${{ matrix.flavor }}.yml
 
       - name: Cont.Struc.Test - Terraform
         uses: devops-infra/action-container-structure-test@v1
         with:
           image: >-
-            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}
+            devopsinfra/docker-terragrunt:${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}${{ env.VERSION_SUFFIX }}
           config: tests/tf.yml
 
       - name: Cont.Struc.Test - OpenTofu
         uses: devops-infra/action-container-structure-test@v1
         with:
           image: >-
-            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}
+            devopsinfra/docker-terragrunt:${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}${{ env.VERSION_SUFFIX }}
           config: tests/ot.yml
diff --git a/.github/workflows/cron-dependency-update.yml b/.github/workflows/cron-dependency-update.yml
index 169a662f..87faf12b 100644
--- a/.github/workflows/cron-dependency-update.yml
+++ b/.github/workflows/cron-dependency-update.yml
@@ -2,7 +2,7 @@ name: (C) Dependency Update
 
 on:
   schedule:
-    - cron: 0 6 * * 1
+    - cron: 0 5 * * 1
   workflow_dispatch:
 
 permissions:
@@ -61,11 +61,11 @@ jobs:
 
   build-and-push:
     name: Build and push
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04-arm
     timeout-minutes: 90
     needs: [check]
     env:
-      VERSION_PREFIX: test-
+      VERSION_SUFFIX: -test
     strategy:
       fail-fast: false
       matrix:
@@ -111,7 +111,7 @@ jobs:
           SOPS_VERSION=$(sed -nE 's/^ARG SOPS_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
           AWS_VERSION=$(sed -nE 's/^aws-cli~=([0-9]+\.[0-9]+)$/\1/p' alpine-packages-aws.txt | head -1)
           GCP_VERSION=$(sed -nE 's/^ARG GCP_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
-          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
+          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile.azure | head -1)
           {
             echo "TF_VERSION=${TF_VERSION}"
             echo "OT_VERSION=${OT_VERSION}"
@@ -146,35 +146,35 @@ jobs:
             done
           }
           sleep 5
-          pull_with_retry "${GHCR_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}"
-          pull_with_retry "${GHCR_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}"
-          pull_with_retry "${DOCKER_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}"
-          pull_with_retry "${DOCKER_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}"
+          pull_with_retry "${GHCR_IMAGE}:${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}${{ env.VERSION_SUFFIX }}"
+          pull_with_retry "${GHCR_IMAGE}:${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}${{ env.VERSION_SUFFIX }}"
+          pull_with_retry "${DOCKER_IMAGE}:${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}${{ env.VERSION_SUFFIX }}"
+          pull_with_retry "${DOCKER_IMAGE}:${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}${{ env.VERSION_SUFFIX }}"
 
       - name: Cont.Struc.Test - ${{ matrix.flavor }} (TF image)
         uses: devops-infra/action-container-structure-test@v1
         with:
           image: >-
-            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}
+            devopsinfra/docker-terragrunt:${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}${{ env.VERSION_SUFFIX }}
           config: tests/${{ matrix.flavor }}.yml
 
       - name: Cont.Struc.Test - ${{ matrix.flavor }} (OT image)
         uses: devops-infra/action-container-structure-test@v1
         with:
           image: >-
-            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}
+            devopsinfra/docker-terragrunt:${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}${{ env.VERSION_SUFFIX }}
           config: tests/${{ matrix.flavor }}.yml
 
       - name: Cont.Struc.Test - Terraform
         uses: devops-infra/action-container-structure-test@v1
         with:
           image: >-
-            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}
+            devopsinfra/docker-terragrunt:${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}${{ env.VERSION_SUFFIX }}
           config: tests/tf.yml
 
       - name: Cont.Struc.Test - OpenTofu
         uses: devops-infra/action-container-structure-test@v1
         with:
           image: >-
-            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}
+            devopsinfra/docker-terragrunt:${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}${{ env.VERSION_SUFFIX }}
           config: tests/ot.yml
diff --git a/.github/workflows/manual-release-create.yml b/.github/workflows/manual-release-create.yml
index 422ac8b4..ddd2df36 100644
--- a/.github/workflows/manual-release-create.yml
+++ b/.github/workflows/manual-release-create.yml
@@ -77,7 +77,7 @@ jobs:
   build-and-push:
     name: Build & push
     if: ${{ !inputs.build-and-push-only }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04-arm
     timeout-minutes: 90
     needs: [lint, prepare]
     strategy:
@@ -125,7 +125,7 @@ jobs:
           SOPS_VERSION=$(sed -nE 's/^ARG SOPS_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
           AWS_VERSION=$(sed -nE 's/^aws-cli~=([0-9]+\.[0-9]+)$/\1/p' alpine-packages-aws.txt | head -1)
           GCP_VERSION=$(sed -nE 's/^ARG GCP_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
-          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
+          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile.azure | head -1)
           {
             echo "TF_VERSION=${TF_VERSION}"
             echo "OT_VERSION=${OT_VERSION}"
@@ -193,7 +193,7 @@ jobs:
   build-and-push-only:
     name: Build & push only
     if: ${{ inputs.build-and-push-only }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04-arm
     timeout-minutes: 90
     strategy:
       fail-fast: false
@@ -249,7 +249,7 @@ jobs:
           SOPS_VERSION=$(sed -nE 's/^ARG SOPS_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
           AWS_VERSION=$(sed -nE 's/^aws-cli~=([0-9]+\.[0-9]+)$/\1/p' alpine-packages-aws.txt | head -1)
           GCP_VERSION=$(sed -nE 's/^ARG GCP_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
-          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
+          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile.azure | head -1)
           {
             echo "TF_VERSION=${TF_VERSION}"
             echo "OT_VERSION=${OT_VERSION}"
diff --git a/Dockerfile b/Dockerfile
index 79c8fc43..98d6083f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,14 +10,11 @@ ARG SLIM=no
 ARG TF=yes
 ARG OT=no
 ARG TG=yes
-ARG AZURE=no
 ARG AWS=no
 ARG GCP=no
-ARG YC=no
 
 # Versions of dependencies
 ARG GCP_VERSION=575.0.0
-ARG AZ_VERSION=2.87.0
 ARG TF_VERSION=1.15.7
 ARG OT_VERSION=1.12.3
 ARG TG_VERSION=1.1.0
@@ -47,7 +44,6 @@ RUN targetarch="${TARGETARCH:-}"; \
   echo "TARGETARCH=${targetarch}"; \
   echo "AWS=${AWS}"; \
   echo "GCP=${GCP} GCP_VERSION=${GCP_VERSION}"; \
-  echo "AZURE=${AZURE} AZ_VERSION=${AZ_VERSION}"; \
   echo "TF=${TF} TF_VERSION=${TF_VERSION}"; \
   echo "OT=${OT} OT_VERSION=${OT_VERSION}"; \
   echo "TG=${TG} TG_VERSION=${TG_VERSION}"; \
@@ -65,6 +61,7 @@ RUN xargs -r apk add --no-cache < /tmp/alpine-packages.txt; \
     pip3 install --no-cache-dir -r /tmp/pip_common_requirements.txt; \
     ln -sf /usr/bin/python3 /usr/bin/python; \
     ln -sf /usr/bin/pip3 /usr/bin/pip; \
+    ln -sf /usr/bin/go-task /usr/bin/task; \
   fi
 
 # Install Terraform/OpenTofu/Terragrunt
@@ -181,16 +178,6 @@ RUN if [ "${GCP}" = "yes" ]; then \
     gcloud config set metrics/environment github_docker_image; \
   fi
 
-SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
-RUN if [ "${AZURE}" = "yes" ]; then \
-    if [ "${SLIM}" = "yes" ]; then \
-      echo "Azure flavor requires non-slim dependencies"; \
-      exit 1; \
-    fi; \
-    pip3 install --no-cache-dir "azure-cli==${AZ_VERSION}"; \
-    test "$(az version --output json | jq -r '."azure-cli"')" = "${AZ_VERSION}"; \
-  fi
-
 COPY fmt/format-hcl fmt/fmt.sh fmt/terragrunt-fmt.sh entrypoint.sh /usr/bin/
 SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
 RUN chmod +x \
@@ -205,7 +192,6 @@ RUN chmod +x \
   hcledit version >/dev/null 2>&1 || true; \
   sops --version >/dev/null 2>&1 || true; \
   aws --version >/dev/null 2>&1 || true; \
-  az --version >/dev/null 2>&1 || true; \
   gcloud --version >/dev/null 2>&1 || true; \
   rm -rf /var/cache/*; \
   rm -rf /root/.cache/*; \
diff --git a/Dockerfile.azure b/Dockerfile.azure
new file mode 100644
index 00000000..32b0c759
--- /dev/null
+++ b/Dockerfile.azure
@@ -0,0 +1,205 @@
+ARG AZ_VERSION=2.87.0
+
+FROM ghcr.io/devops-infra/docker-azure-cli:${AZ_VERSION}
+
+ARG AZ_VERSION
+
+ENV PIP_BREAK_SYSTEM_PACKAGES=1
+
+# Multi-architecture from buildx
+ARG TARGETARCH
+
+# Which flavor of image to build
+ARG SLIM=no
+ARG TF=yes
+ARG OT=no
+ARG TG=yes
+ARG AWS=no
+ARG GCP=no
+
+# Versions of dependencies
+ARG GCP_VERSION=575.0.0
+ARG TF_VERSION=1.15.7
+ARG OT_VERSION=1.12.3
+ARG TG_VERSION=1.1.0
+
+# Pinned tool versions (override via --build-arg if needed)
+ARG TFLINT_VERSION=0.63.1
+ARG HCLEDIT_VERSION=0.2.18
+ARG SOPS_VERSION=3.13.2
+
+COPY alpine-packages.txt /tmp/alpine-packages.txt
+COPY alpine-packages-nonslim.txt /tmp/alpine-packages-nonslim.txt
+COPY alpine-packages-aws.txt /tmp/alpine-packages-aws.txt
+COPY pip/common/requirements.txt /tmp/pip_common_requirements.txt
+COPY pip/aws/requirements.txt /tmp/pip_aws_requirements.txt
+
+SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
+RUN targetarch="${TARGETARCH:-}"; \
+  if [ -z "${targetarch}" ]; then \
+    case "$(uname -m)" in \
+      x86_64) targetarch="amd64" ;; \
+      aarch64|arm64) targetarch="arm64" ;; \
+      *) echo "Unsupported host architecture: $(uname -m)"; exit 1 ;; \
+    esac; \
+  fi; \
+  case "${targetarch}" in amd64|arm64) ;; *) echo "Unsupported architecture: ${targetarch}"; exit 1 ;; esac; \
+  echo "TARGETARCH=${targetarch}"; \
+  echo "AWS=${AWS}"; \
+  echo "GCP=${GCP} GCP_VERSION=${GCP_VERSION}"; \
+  echo "AZ_VERSION=${AZ_VERSION}"; \
+  echo "TF=${TF} TF_VERSION=${TF_VERSION}"; \
+  echo "OT=${OT} OT_VERSION=${OT_VERSION}"; \
+  echo "TG=${TG} TG_VERSION=${TG_VERSION}"; \
+  echo "TFLINT_VERSION=${TFLINT_VERSION}"; \
+  echo "HCLEDIT_VERSION=${HCLEDIT_VERSION}"; \
+  echo "SOPS_VERSION=${SOPS_VERSION}"; \
+  printf '%s' "${targetarch}" > /tmp/targetarch
+
+SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
+# hadolint ignore=DL3018
+RUN sed -i 's#/alpine/v3\.23/#/alpine/v3.24/#g' /etc/apk/repositories; \
+  apk upgrade --no-cache --available; \
+  xargs -r apk add --no-cache < /tmp/alpine-packages.txt; \
+  if [ "${SLIM}" = "no" ]; then \
+    xargs -r apk add --no-cache < /tmp/alpine-packages-nonslim.txt; \
+    pip3 install --no-cache-dir -r /tmp/pip_common_requirements.txt; \
+    ln -sf /usr/bin/python3 /usr/bin/python; \
+    ln -sf /usr/bin/pip3 /usr/bin/pip; \
+    ln -sf /usr/bin/go-task /usr/bin/task; \
+  fi
+
+SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
+# hadolint ignore=SC2155
+RUN ARCHITECTURE="$(cat /tmp/targetarch)"; \
+  TMP_DIR="$(mktemp -d)"; \
+  checksum_for() { \
+    url="$1"; \
+    pattern="$2"; \
+    checksum_file="${TMP_DIR}/checksums.txt"; \
+    curl -fsSL "${url}" -o "${checksum_file}"; \
+    awk -v arch="${ARCHITECTURE}" -v pattern="${pattern}" '$0 ~ pattern {print $1; exit}' "${checksum_file}"; \
+  }; \
+  install_zip_binary() { \
+    url="$1"; \
+    binary_name="$2"; \
+    sha256="$3"; \
+    zip_path="${TMP_DIR}/${binary_name}.zip"; \
+    curl -fsSL "${url}" -o "${zip_path}"; \
+    echo "${sha256}  ${zip_path}" | sha256sum -c -; \
+    unzip -q "${zip_path}" -d "${TMP_DIR}"; \
+    chmod +x "${TMP_DIR}/${binary_name}"; \
+    mv "${TMP_DIR}/${binary_name}" "/usr/bin/${binary_name}"; \
+  }; \
+  if [ "${TF}" = "yes" ]; then \
+    TF_SHA256="$(checksum_for "https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_SHA256SUMS" "terraform_[0-9.]+_linux_${ARCHITECTURE}\\.zip$")"; \
+    [ -n "${TF_SHA256}" ] || { echo "Missing Terraform checksum for ${TF_VERSION}/${ARCHITECTURE}"; exit 1; }; \
+    install_zip_binary "https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_${ARCHITECTURE}.zip" terraform "${TF_SHA256}"; \
+  fi; \
+  if [ "${OT}" = "yes" ]; then \
+    OT_SHA256="$(checksum_for "https://github.com/opentofu/opentofu/releases/download/v${OT_VERSION}/tofu_${OT_VERSION}_SHA256SUMS" "tofu_[0-9.]+_linux_${ARCHITECTURE}\\.tar\\.gz$")"; \
+    [ -n "${OT_SHA256}" ] || { echo "Missing OpenTofu checksum for ${OT_VERSION}/${ARCHITECTURE}"; exit 1; }; \
+    curl -fsSL "https://github.com/opentofu/opentofu/releases/download/v${OT_VERSION}/tofu_${OT_VERSION}_linux_${ARCHITECTURE}.tar.gz" -o "${TMP_DIR}/tofu.tar.gz"; \
+    echo "${OT_SHA256}  ${TMP_DIR}/tofu.tar.gz" | sha256sum -c -; \
+    tar -xzf "${TMP_DIR}/tofu.tar.gz" -C "${TMP_DIR}" tofu; \
+    chmod +x "${TMP_DIR}/tofu"; \
+    mv "${TMP_DIR}/tofu" /usr/bin/tofu; \
+  fi; \
+  if [ "${TG}" = "yes" ]; then \
+    TG_SHA256="$(checksum_for "https://github.com/gruntwork-io/terragrunt/releases/download/v${TG_VERSION}/SHA256SUMS" "terragrunt_linux_${ARCHITECTURE}$")"; \
+    [ -n "${TG_SHA256}" ] || { echo "Missing Terragrunt checksum for ${TG_VERSION}/${ARCHITECTURE}"; exit 1; }; \
+    curl -fsSL "https://github.com/gruntwork-io/terragrunt/releases/download/v${TG_VERSION}/terragrunt_linux_${ARCHITECTURE}" -o /usr/bin/terragrunt; \
+    echo "${TG_SHA256}  /usr/bin/terragrunt" | sha256sum -c -; \
+    chmod +x /usr/bin/terragrunt; \
+  fi; \
+  rm -rf "${TMP_DIR}"
+
+SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
+# hadolint ignore=SC2155
+RUN if [ "${SLIM}" = "no" ]; then \
+    ARCHITECTURE="$(cat /tmp/targetarch)"; \
+    TMP_DIR="$(mktemp -d)"; \
+    checksum_for() { \
+      url="$1"; \
+      pattern="$2"; \
+      checksum_file="${TMP_DIR}/checksums.txt"; \
+      curl -fsSL "${url}" -o "${checksum_file}"; \
+      awk -v pattern="${pattern}" '$0 ~ pattern {print $1; exit}' "${checksum_file}"; \
+    }; \
+    TFLINT_SHA256="$(checksum_for "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt" "tflint_linux_${ARCHITECTURE}\\.zip$")"; \
+    [ -n "${TFLINT_SHA256}" ] || { echo "Missing TFLint checksum for ${TFLINT_VERSION}/${ARCHITECTURE}"; exit 1; }; \
+    HCLEDIT_SHA256="$(checksum_for "https://github.com/minamijoyo/hcledit/releases/download/v${HCLEDIT_VERSION}/hcledit_${HCLEDIT_VERSION}_checksums.txt" "hcledit_[0-9.]+_linux_${ARCHITECTURE}\\.tar\\.gz$")"; \
+    [ -n "${HCLEDIT_SHA256}" ] || { echo "Missing hcledit checksum for ${HCLEDIT_VERSION}/${ARCHITECTURE}"; exit 1; }; \
+    SOPS_SHA256="$(checksum_for "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.checksums.txt" "sops-v[0-9.]+\\.linux\\.${ARCHITECTURE}$")"; \
+    [ -n "${SOPS_SHA256}" ] || { echo "Missing sops checksum for ${SOPS_VERSION}/${ARCHITECTURE}"; exit 1; }; \
+    curl -fsSL "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/tflint_linux_${ARCHITECTURE}.zip" -o "${TMP_DIR}/tflint.zip"; \
+    echo "${TFLINT_SHA256}  ${TMP_DIR}/tflint.zip" | sha256sum -c -; \
+    unzip -q "${TMP_DIR}/tflint.zip" -d "${TMP_DIR}"; \
+    chmod +x "${TMP_DIR}/tflint"; \
+    mv "${TMP_DIR}/tflint" /usr/bin/tflint; \
+    curl -fsSL "https://github.com/minamijoyo/hcledit/releases/download/v${HCLEDIT_VERSION}/hcledit_${HCLEDIT_VERSION}_linux_${ARCHITECTURE}.tar.gz" -o "${TMP_DIR}/hcledit.tar.gz"; \
+    echo "${HCLEDIT_SHA256}  ${TMP_DIR}/hcledit.tar.gz" | sha256sum -c -; \
+    tar -xzf "${TMP_DIR}/hcledit.tar.gz" -C "${TMP_DIR}"; \
+    chmod +x "${TMP_DIR}/hcledit"; \
+    mv "${TMP_DIR}/hcledit" /usr/bin/hcledit; \
+    curl -fsSL "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.${ARCHITECTURE}" -o /usr/bin/sops; \
+    echo "${SOPS_SHA256}  /usr/bin/sops" | sha256sum -c -; \
+    chmod +x /usr/bin/sops; \
+    rm -rf "${TMP_DIR}"; \
+  fi
+
+SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
+RUN if [ "${AWS}" = "yes" ]; then \
+    if [ "${SLIM}" = "yes" ]; then \
+      echo "AWS flavor requires non-slim dependencies"; \
+      exit 1; \
+    fi; \
+    xargs -n 1 -a /tmp/pip_aws_requirements.txt pip3 install --no-cache-dir; \
+    xargs -r apk add --no-cache < /tmp/alpine-packages-aws.txt; \
+    aws --version | grep -Eq '^aws-cli/[0-9]+\.[0-9]+'; \
+  fi
+
+SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
+RUN if [ "${GCP}" = "yes" ]; then \
+    if [ "${SLIM}" = "yes" ]; then \
+      echo "GCP flavor requires non-slim dependencies"; \
+      exit 1; \
+    fi; \
+    ARCHITECTURE="$(cat /tmp/targetarch)"; \
+    case "${ARCHITECTURE}" in \
+      amd64) GCP_ARCH="x86_64" ;; \
+      arm64) GCP_ARCH="arm" ;; \
+      *) echo "Unsupported architecture for GCP CLI: ${ARCHITECTURE}"; exit 1 ;; \
+    esac; \
+    mkdir -p /opt; \
+    curl -fsSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-${GCP_VERSION}-linux-${GCP_ARCH}.tar.gz" -o /tmp/google-cloud-cli.tar.gz; \
+    tar -xzf /tmp/google-cloud-cli.tar.gz -C /opt; \
+    /opt/google-cloud-sdk/install.sh --quiet --path-update=false --usage-reporting=false --command-completion=false --rc-path=/dev/null; \
+    ln -sf /opt/google-cloud-sdk/bin/gcloud /usr/bin/gcloud; \
+    gcloud config set component_manager/disable_update_check true; \
+    gcloud config set metrics/environment github_docker_image; \
+  fi
+
+COPY fmt/format-hcl fmt/fmt.sh fmt/terragrunt-fmt.sh entrypoint.sh /usr/bin/
+SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
+RUN chmod +x \
+    /usr/bin/format-hcl \
+    /usr/bin/fmt.sh \
+    /usr/bin/terragrunt-fmt.sh \
+    /usr/bin/entrypoint.sh; \
+  terraform version >/dev/null 2>&1 || true; \
+  tofu --version >/dev/null 2>&1 || true; \
+  terragrunt --version >/dev/null 2>&1; \
+  tflint --version >/dev/null 2>&1 || true; \
+  hcledit version >/dev/null 2>&1 || true; \
+  sops --version >/dev/null 2>&1 || true; \
+  aws --version >/dev/null 2>&1 || true; \
+  az --version >/dev/null 2>&1; \
+  test "$(az version --output json | jq -r '."azure-cli"')" = "${AZ_VERSION}"; \
+  gcloud --version >/dev/null 2>&1 || true; \
+  rm -rf /var/cache/*; \
+  rm -rf /root/.cache/*; \
+  rm -rf /tmp/*
+
+WORKDIR /data
+CMD ["entrypoint.sh"]
diff --git a/README.md b/README.md
index 3063ffa5..7605eef4 100644
--- a/README.md
+++ b/README.md
@@ -19,6 +19,8 @@ Alpine-based Docker image with Terraform or OpenTofu, together with Terragrunt,
 
 Including cloud CLIs and SDKs for **Amazon Web Services, Microsoft Azure, Google Cloud Platform**.
 
+Azure-enabled flavors are built on top of `devops-infra/docker-azure-cli` to reduce Azure CLI install time during image builds.
+
 **Best used as runner image for CI/CD in automation, as well as a consistent local run environment.**
 
 Please note focus of those images is to maintain availability of current versions of **Terraform, OpenTofu and Terragrunt**, not CLIs or other dependencies.
diff --git a/Taskfile.docker.yml b/Taskfile.docker.yml
index 79c26cf9..ede955b2 100644
--- a/Taskfile.docker.yml
+++ b/Taskfile.docker.yml
@@ -38,32 +38,32 @@ tasks:
   docker:cmds:
     desc: Show docker build command for plain flavor
     cmds:
-      - task terragrunt:build:plain --dry VERSION_PREFIX='{{.CI_VERSION_PREFIX}}'
+      - task terragrunt:build:plain --dry VERSION_SUFFIX='{{.EFFECTIVE_SUFFIX}}'
 
   docker:build:
     desc: Build Docker image (plain flavor)
     cmds:
-      - task terragrunt:build:plain VERSION_PREFIX='{{.CI_VERSION_PREFIX}}'
+      - task terragrunt:build:plain VERSION_SUFFIX='{{.EFFECTIVE_SUFFIX}}'
 
   docker:build:inspect:
     desc: Inspect built Docker image (plain latest)
     cmds:
       - |
         set -eu
-        image="{{.DOCKER_NAME}}:{{.CI_VERSION_PREFIX}}plain-latest"
+        image="{{.DOCKER_NAME}}:plain-latest{{.EFFECTIVE_SUFFIX}}"
         echo "Inspecting image: ${image}"
         docker image inspect "$image" | jq || true
 
   docker:push:
     desc: Build and push Docker images (plain flavor)
     cmds:
-      - task terragrunt:push:plain VERSION_PREFIX='{{.CI_VERSION_PREFIX}}'
+      - task terragrunt:push:plain VERSION_SUFFIX='{{.EFFECTIVE_SUFFIX}}'
 
   docker:push:inspect:
     desc: Inspect pushed Docker image (plain latest)
     cmds:
       - |
         set -eu
-        image="{{.DOCKER_NAME}}:{{.CI_VERSION_PREFIX}}plain-latest"
+        image="{{.DOCKER_NAME}}:plain-latest{{.EFFECTIVE_SUFFIX}}"
         echo "Inspecting pushed image: ${image}"
         docker buildx imagetools inspect "$image" || docker manifest inspect "$image"
diff --git a/Taskfile.scripts.yml b/Taskfile.scripts.yml
index c00d5987..c23a068c 100644
--- a/Taskfile.scripts.yml
+++ b/Taskfile.scripts.yml
@@ -28,12 +28,18 @@ tasks:
         fi
 
   lint:hadolint:
-    desc: Lint Dockerfile with hadolint
+    desc: Lint Dockerfiles with hadolint
+    shell: bash
     cmds:
       - |
         echo "▶️ Running hadolint..."
+        mapfile -t files < <(git ls-files 'Dockerfile*')
+        if [ "${#files[@]}" -eq 0 ]; then
+          echo "ℹ️ No Dockerfiles found, skipping hadolint"
+          exit 0
+        fi
         set +e
-        docker run --rm -i -v "$PWD:/work" -w /work hadolint/hadolint:latest-debian < Dockerfile
+        docker run --rm -i -v "$PWD:/work" -w /work hadolint/hadolint:latest-debian /bin/hadolint "${files[@]}"
         rc=$?
         set -e
         if [ "$rc" -eq 0 ]; then
@@ -90,6 +96,81 @@ tasks:
       - git config user.name "github-actions[bot]"
       - git config user.email "github-actions[bot]@users.noreply.github.com"
 
+  alpine:update:
+    desc: Update Alpine base image references and VERSION_ID test expectations
+    cmds:
+      - |
+        set -eu
+        if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+          echo "INFO: Not in a git repository; nothing to update"
+          exit 0
+        fi
+
+        mkdir -p .tmp
+        tracked_files=".tmp/alpine-update-files.txt"
+        relevant_files=".tmp/alpine-update-relevant.txt"
+        git ls-files > "$tracked_files"
+        grep -E '(^|/)(Dockerfile[^/]*|[^/]+\.sh|\.github/workflows/.*\.ya?ml|tests/.*\.ya?ml)$' "$tracked_files" > "$relevant_files" || true
+
+        if [ ! -s "$relevant_files" ]; then
+          echo "INFO: No tracked Alpine-related source files found; nothing to update"
+          exit 0
+        fi
+
+        latest_feed="$(curl -fsSL https://dl-cdn.alpinelinux.org/alpine/latest-stable/releases/x86_64/latest-releases.yaml)"
+        latest_alpine="$(printf '%s\n' "$latest_feed" | awk '/^  version:/ {print $2}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)"
+        if [ -z "$latest_alpine" ]; then
+          echo "ERROR: Could not resolve latest Alpine release"
+          exit 1
+        fi
+        escaped_alpine="$(printf '%s' "$latest_alpine" | sed 's/\./\\\\./g')"
+
+        found_refs=0
+        while IFS= read -r file; do
+          [ -n "$file" ] || continue
+          if grep -Eq 'alpine:[0-9]+\.[0-9]+\.[0-9]+|expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+(\\?\.[0-9]+){2}\]' "$file"; then
+            found_refs=1
+            break
+          fi
+        done < "$relevant_files"
+
+        if [ "$found_refs" -eq 0 ]; then
+          echo "INFO: No Alpine version references found in tracked source files; nothing to update"
+          exit 0
+        fi
+
+        updated=0
+        while IFS= read -r file; do
+          [ -n "$file" ] || continue
+          before_file=".tmp/alpine-update-before"
+          cp "$file" "$before_file"
+          perl -0pi -e 's/alpine:\d+\.\d+\.\d+/alpine:'"$latest_alpine"'/g' "$file"
+          if printf '%s\n' "$file" | grep -Eq '^tests/.*\.ya?ml$'; then
+            perl -0pi -e 's/expectedOutput:\s*\[VERSION_ID=\d+(?:\\?\.\d+){2}\]/expectedOutput: [VERSION_ID='"$escaped_alpine"']/g' "$file"
+          fi
+          if ! cmp -s "$file" "$before_file"; then
+            echo "UPDATE: Alpine references in $file -> $latest_alpine"
+            updated=1
+          fi
+        done < "$relevant_files"
+        rm -f .tmp/alpine-update-before
+
+        if xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" >/dev/null 2>&1; then
+          echo "ERROR: Found unescaped VERSION_ID expectations after update"
+          xargs grep -En 'expectedOutput:[[:space:]]*\[VERSION_ID=[0-9]+\.[0-9]+\.[0-9]+\]' < "$relevant_files" || true
+          exit 1
+        fi
+
+        if xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" >/dev/null 2>&1; then
+          echo "ERROR: Found escaped Alpine image tags after update"
+          xargs grep -En 'alpine:[0-9]+\\\.[0-9]+\\\.[0-9]+' < "$relevant_files" || true
+          exit 1
+        fi
+
+        if [ "$updated" -eq 0 ]; then
+          echo "INFO: Alpine references already up to date"
+        fi
+
   packages:update:
     desc: Update Alpine package pins in alpine-packages*.txt
     cmds:
diff --git a/Taskfile.terragrunt.yml b/Taskfile.terragrunt.yml
index 97e4dfa1..bce545f8 100644
--- a/Taskfile.terragrunt.yml
+++ b/Taskfile.terragrunt.yml
@@ -14,7 +14,7 @@ vars:
   GCP_VERSION:
     sh: sed -nE 's/^ARG GCP_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1
   AZ_VERSION:
-    sh: sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1
+    sh: sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile.azure | head -1
   TF_VERSION:
     sh: sed -nE 's/^ARG TF_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1
   OT_VERSION:
@@ -31,8 +31,8 @@ vars:
     sh: echo "${GITHUB_REF:-refs/heads/null}"
   GITHUB_SHA:
     sh: echo "${GITHUB_SHA:-aabbccddeeff}"
-  VERSION_PREFIX:
-    sh: echo "${VERSION_PREFIX:-}"
+  VERSION_SUFFIX:
+    sh: echo "${VERSION_SUFFIX:-}"
   VERSION_OVERRIDE:
     sh: echo "${VERSION_OVERRIDE:-}"
   GITHUB_SHORT_SHA:
@@ -85,23 +85,8 @@ vars:
   LABEL_REPO_URL: https://github.com/devops-infra/docker-terragrunt
   LABEL_HOMEPAGE: https://shyper.pro
   LABEL_VENDOR: DevOps-Infra
-  CI_VERSION_PREFIX:
-    sh: |
-      if [ -n "${VERSION_PREFIX:-}" ]; then
-        printf "%s" "${VERSION_PREFIX}"
-      elif [ -n "${VERSION_SUFFIX:-}" ]; then
-        suffix="${VERSION_SUFFIX#-}"
-        if [ -n "$suffix" ]; then
-          printf "%s-" "$suffix"
-        fi
-      fi
-  EFFECTIVE_PREFIX:
-    sh: |
-      if [ -n "${VERSION_PREFIX:-}" ]; then
-        printf "%s" "${VERSION_PREFIX}"
-      else
-        printf "%s" "{{.CI_VERSION_PREFIX}}"
-      fi
+  EFFECTIVE_SUFFIX:
+    sh: printf "%s" "${VERSION_SUFFIX:-}"
 
 tasks:
   terragrunt:help:
@@ -124,6 +109,7 @@ tasks:
   dependency:update:
     desc: Check TF, OT, TG, cloud CLIs and helper binary versions
     cmds:
+      - task: scripts:alpine:update
       - task: scripts:packages:update
       - |
         set -eu
@@ -179,12 +165,28 @@ tasks:
           aws_latest="{{.AWS_VERSION}}"
         fi
         aws_current="aws-cli~={{.AWS_VERSION}}"
+        cloudflare_current="$(sed -nE 's/^cloudflare==([^[:space:]#]+).*$/\1/p' pip/common/requirements.txt)"
+        pygithub_current="$(sed -nE 's/^PyGithub==([^[:space:]#]+).*$/\1/p' pip/common/requirements.txt)"
+        python_hcl2_current="$(sed -nE 's/^python-hcl2==([^[:space:]#]+).*$/\1/p' pip/common/requirements.txt)"
+        requests_current="$(sed -nE 's/^requests==([^[:space:]#]+).*$/\1/p' pip/common/requirements.txt)"
+        slack_sdk_current="$(sed -nE 's/^slack_sdk==([^[:space:]#]+).*$/\1/p' pip/common/requirements.txt)"
+        anyio_current="$(sed -nE 's/^anyio==([^[:space:]#]+).*$/\1/p' pip/common/requirements.txt)"
+        zipp_current="$(sed -nE 's/^zipp==([^[:space:]#]+).*$/\1/p' pip/common/requirements.txt)"
+        boto3_current="$(sed -nE 's/^boto3==([^[:space:]#]+).*$/\1/p' pip/aws/requirements.txt)"
         gcp_latest=$(curl -LsS https://cloud.google.com/sdk/docs/downloads-versioned-archives \
           | grep -Eo 'google-cloud-sdk-[0-9.]+' | head -1 | sed 's/google-cloud-sdk-//')
-        az_latest=$(curl -LsS https://pypi.org/pypi/azure-cli/json | jq -r '.info.version')
+        az_latest=$(curl -LsS https://api.github.com/repos/devops-infra/docker-azure-cli/releases/latest | jq -r '.tag_name')
         tflint_latest=$(curl -LsS https://api.github.com/repos/terraform-linters/tflint/releases/latest | jq -r .tag_name | sed 's/^v//')
         hcledit_latest=$(curl -LsS https://api.github.com/repos/minamijoyo/hcledit/releases/latest | jq -r .tag_name | sed 's/^v//')
         sops_latest=$(curl -LsS https://api.github.com/repos/getsops/sops/releases/latest | jq -r .tag_name | sed 's/^v//')
+        cloudflare_latest=$(curl -LsS https://pypi.org/pypi/cloudflare/json | jq -r '.info.version')
+        pygithub_latest=$(curl -LsS https://pypi.org/pypi/PyGithub/json | jq -r '.info.version')
+        python_hcl2_latest=$(curl -LsS https://pypi.org/pypi/python-hcl2/json | jq -r '.info.version')
+        requests_latest=$(curl -LsS https://pypi.org/pypi/requests/json | jq -r '.info.version')
+        slack_sdk_latest=$(curl -LsS https://pypi.org/pypi/slack_sdk/json | jq -r '.info.version')
+        anyio_latest=$(curl -LsS https://pypi.org/pypi/anyio/json | jq -r '.info.version')
+        zipp_latest=$(curl -LsS https://pypi.org/pypi/zipp/json | jq -r '.info.version')
+        boto3_latest=$(curl -LsS https://pypi.org/pypi/boto3/json | jq -r '.info.version')
 
         echo "Current Terraform: {{.TF_VERSION}} | Latest: $tf_latest"
         echo "Current Terragrunt: {{.TG_VERSION}} | Latest: $tg_latest"
@@ -195,6 +197,14 @@ tasks:
         echo "Current TFLint: {{.TFLINT_VERSION}} | Latest: $tflint_latest"
         echo "Current hcledit: {{.HCLEDIT_VERSION}} | Latest: $hcledit_latest"
         echo "Current sops: {{.SOPS_VERSION}} | Latest: $sops_latest"
+        echo "Current cloudflare: $cloudflare_current | Latest: $cloudflare_latest"
+        echo "Current PyGithub: $pygithub_current | Latest: $pygithub_latest"
+        echo "Current python-hcl2: $python_hcl2_current | Latest: $python_hcl2_latest"
+        echo "Current requests: $requests_current | Latest: $requests_latest"
+        echo "Current slack_sdk: $slack_sdk_current | Latest: $slack_sdk_latest"
+        echo "Current anyio: $anyio_current | Latest: $anyio_latest"
+        echo "Current zipp: $zipp_current | Latest: $zipp_latest"
+        echo "Current boto3: $boto3_current | Latest: $boto3_latest"
 
         update_file() {
           file="$1"
@@ -214,15 +224,37 @@ tasks:
           {{.SED}} -i "s|^ARG ${key}=.*$|ARG ${key}=${value}|g" "$file"
         }
 
+        set_requirement() {
+          file="$1"
+          package="$2"
+          version="$3"
+          {{.SED}} -E -i "s|^(${package}==)[^[:space:]#]+|\\1${version}|g" "$file"
+        }
+
         set_arg Dockerfile TF_VERSION "$tf_latest"
+        set_arg Dockerfile.azure TF_VERSION "$tf_latest"
         set_arg Dockerfile OT_VERSION "$ot_latest"
+        set_arg Dockerfile.azure OT_VERSION "$ot_latest"
         set_arg Dockerfile TG_VERSION "$tg_latest"
+        set_arg Dockerfile.azure TG_VERSION "$tg_latest"
         set_arg Dockerfile GCP_VERSION "$gcp_latest"
-        set_arg Dockerfile AZ_VERSION "$az_latest"
+        set_arg Dockerfile.azure GCP_VERSION "$gcp_latest"
+        set_arg Dockerfile.azure AZ_VERSION "$az_latest"
         set_arg Dockerfile TFLINT_VERSION "$tflint_latest"
+        set_arg Dockerfile.azure TFLINT_VERSION "$tflint_latest"
         set_arg Dockerfile HCLEDIT_VERSION "$hcledit_latest"
+        set_arg Dockerfile.azure HCLEDIT_VERSION "$hcledit_latest"
         set_arg Dockerfile SOPS_VERSION "$sops_latest"
+        set_arg Dockerfile.azure SOPS_VERSION "$sops_latest"
         update_file alpine-packages-aws.txt "$aws_current" "aws-cli~=$aws_latest"
+        set_requirement pip/common/requirements.txt cloudflare "$cloudflare_latest"
+        set_requirement pip/common/requirements.txt PyGithub "$pygithub_latest"
+        set_requirement pip/common/requirements.txt python-hcl2 "$python_hcl2_latest"
+        set_requirement pip/common/requirements.txt requests "$requests_latest"
+        set_requirement pip/common/requirements.txt slack_sdk "$slack_sdk_latest"
+        set_requirement pip/common/requirements.txt anyio "$anyio_latest"
+        set_requirement pip/common/requirements.txt zipp "$zipp_latest"
+        set_requirement pip/aws/requirements.txt boto3 "$boto3_latest"
 
         update_file README.md "{{.TF_VERSION}}" "$tf_latest"
         update_file README.md "{{.TG_VERSION}}" "$tg_latest"
@@ -235,6 +267,14 @@ tasks:
         [ "{{.AWS_VERSION}}" = "$aws_latest" ] || version_tag="$version_tag aws-$aws_latest"
         [ "{{.GCP_VERSION}}" = "$gcp_latest" ] || version_tag="$version_tag gcp-$gcp_latest"
         [ "{{.AZ_VERSION}}" = "$az_latest" ] || version_tag="$version_tag az-$az_latest"
+        [ "$cloudflare_current" = "$cloudflare_latest" ] || version_tag="$version_tag cloudflare-$cloudflare_latest"
+        [ "$pygithub_current" = "$pygithub_latest" ] || version_tag="$version_tag pygithub-$pygithub_latest"
+        [ "$python_hcl2_current" = "$python_hcl2_latest" ] || version_tag="$version_tag python-hcl2-$python_hcl2_latest"
+        [ "$requests_current" = "$requests_latest" ] || version_tag="$version_tag requests-$requests_latest"
+        [ "$slack_sdk_current" = "$slack_sdk_latest" ] || version_tag="$version_tag slack-sdk-$slack_sdk_latest"
+        [ "$anyio_current" = "$anyio_latest" ] || version_tag="$version_tag anyio-$anyio_latest"
+        [ "$zipp_current" = "$zipp_latest" ] || version_tag="$version_tag zipp-$zipp_latest"
+        [ "$boto3_current" = "$boto3_latest" ] || version_tag="$version_tag boto3-$boto3_latest"
         if ! git diff --quiet -- alpine-packages.txt alpine-packages-nonslim.txt alpine-packages-aws.txt 2>/dev/null; then
           version_tag="$version_tag alpine-packages"
         fi
@@ -256,7 +296,7 @@ tasks:
         flavor='{{.FLAVOR}}'
         tool='{{.TOOL}}'
         push='{{default "false" .PUSH}}'
-        prefix='{{.EFFECTIVE_PREFIX}}'
+        suffix='{{.EFFECTIVE_SUFFIX}}'
         tf_tg='{{.TF_TG_VERSION}}'
         ot_tg='{{.OT_TG_VERSION}}'
         full_version='{{.FULL_VERSION}}'
@@ -274,6 +314,7 @@ tasks:
         fi
 
         args=()
+        dockerfile='Dockerfile'
         case "$flavor" in
           slim)
             args+=(--build-arg SLIM=yes)
@@ -290,13 +331,15 @@ tasks:
             include_global_latest='yes'
             ;;
           azure)
-            args+=(--build-arg AZURE=yes)
+            dockerfile='Dockerfile.azure'
+            args+=(--build-arg AZ_VERSION='{{.AZ_VERSION}}')
             tag_prefix='azure-'
             include_global_latest='yes'
             ;;
           aws-azure)
             args+=(--build-arg AWS=yes)
-            args+=(--build-arg AZURE=yes)
+            dockerfile='Dockerfile.azure'
+            args+=(--build-arg AZ_VERSION='{{.AZ_VERSION}}')
             tag_prefix='aws-azure-'
             include_global_latest='yes'
             ;;
@@ -312,14 +355,16 @@ tasks:
             include_global_latest='yes'
             ;;
           azure-gcp)
-            args+=(--build-arg AZURE=yes)
+            dockerfile='Dockerfile.azure'
+            args+=(--build-arg AZ_VERSION='{{.AZ_VERSION}}')
             args+=(--build-arg GCP=yes)
             tag_prefix='azure-gcp-'
             include_global_latest='yes'
             ;;
           aws-azure-gcp)
             args+=(--build-arg AWS=yes)
-            args+=(--build-arg AZURE=yes)
+            dockerfile='Dockerfile.azure'
+            args+=(--build-arg AZ_VERSION='{{.AZ_VERSION}}')
             args+=(--build-arg GCP=yes)
             tag_prefix='aws-azure-gcp-'
             include_global_latest='yes'
@@ -330,7 +375,7 @@ tasks:
             ;;
         esac
 
-        cmd=(docker buildx build --platform linux/amd64,linux/arm64 --file Dockerfile)
+        cmd=(docker buildx build --platform linux/amd64,linux/arm64 --file "$dockerfile")
         cmd+=(--annotation "index:org.label-schema.build-date={{.BUILD_DATE}}")
         cmd+=(--annotation "index:org.label-schema.name={{.LABEL_NAME}}")
         cmd+=(--annotation "index:org.label-schema.description={{.LABEL_DESCRIPTION}}")
@@ -383,6 +428,10 @@ tasks:
         cmd+=(--build-arg TF_VERSION='{{.EFFECTIVE_TF_VERSION}}')
         cmd+=(--build-arg OT_VERSION='{{.EFFECTIVE_OT_VERSION}}')
         cmd+=(--build-arg TG_VERSION='{{.EFFECTIVE_TG_VERSION}}')
+        cmd+=(--build-arg GCP_VERSION='{{.GCP_VERSION}}')
+        cmd+=(--build-arg TFLINT_VERSION='{{.TFLINT_VERSION}}')
+        cmd+=(--build-arg HCLEDIT_VERSION='{{.HCLEDIT_VERSION}}')
+        cmd+=(--build-arg SOPS_VERSION='{{.SOPS_VERSION}}')
         docker_username='{{.DOCKER_USERNAME}}'
         github_username='{{.GITHUB_USERNAME}}'
         has_dockerhub=false
@@ -407,36 +456,36 @@ tasks:
           fi
         fi
         if [ "$has_dockerhub" = true ]; then
-          cmd+=(--tag "{{.DOCKER_NAME}}:${prefix}${tag_prefix}${combo_version}")
-          cmd+=(--tag "{{.DOCKER_NAME}}:${prefix}${tag_prefix}${tool_latest}")
+          cmd+=(--tag "{{.DOCKER_NAME}}:${tag_prefix}${combo_version}${suffix}")
+          cmd+=(--tag "{{.DOCKER_NAME}}:${tag_prefix}${tool_latest}${suffix}")
         fi
         if [ "$has_ghcr" = true ]; then
-          cmd+=(--tag "{{.GITHUB_NAME}}:${prefix}${tag_prefix}${combo_version}")
-          cmd+=(--tag "{{.GITHUB_NAME}}:${prefix}${tag_prefix}${tool_latest}")
+          cmd+=(--tag "{{.GITHUB_NAME}}:${tag_prefix}${combo_version}${suffix}")
+          cmd+=(--tag "{{.GITHUB_NAME}}:${tag_prefix}${tool_latest}${suffix}")
         fi
         if [ "$include_global_latest" = "yes" ] && [ "$tool" = "tf" ]; then
           if [ "$has_dockerhub" = true ]; then
-            cmd+=(--tag "{{.DOCKER_NAME}}:${prefix}${tag_prefix}latest")
+            cmd+=(--tag "{{.DOCKER_NAME}}:${tag_prefix}latest${suffix}")
           fi
           if [ "$has_ghcr" = true ]; then
-            cmd+=(--tag "{{.GITHUB_NAME}}:${prefix}${tag_prefix}latest")
+            cmd+=(--tag "{{.GITHUB_NAME}}:${tag_prefix}latest${suffix}")
           fi
         fi
         if [ "$flavor" = "plain" ]; then
           if [ "$has_dockerhub" = true ]; then
-            cmd+=(--tag "{{.DOCKER_NAME}}:${prefix}${combo_version}")
-            cmd+=(--tag "{{.DOCKER_NAME}}:${prefix}${tool_latest}")
+            cmd+=(--tag "{{.DOCKER_NAME}}:${combo_version}${suffix}")
+            cmd+=(--tag "{{.DOCKER_NAME}}:${tool_latest}${suffix}")
           fi
           if [ "$has_ghcr" = true ]; then
-            cmd+=(--tag "{{.GITHUB_NAME}}:${prefix}${combo_version}")
-            cmd+=(--tag "{{.GITHUB_NAME}}:${prefix}${tool_latest}")
+            cmd+=(--tag "{{.GITHUB_NAME}}:${combo_version}${suffix}")
+            cmd+=(--tag "{{.GITHUB_NAME}}:${tool_latest}${suffix}")
           fi
           if [ "$tool" = "tf" ]; then
             if [ "$has_dockerhub" = true ]; then
-              cmd+=(--tag "{{.DOCKER_NAME}}:${prefix}latest")
+              cmd+=(--tag "{{.DOCKER_NAME}}:latest${suffix}")
             fi
             if [ "$has_ghcr" = true ]; then
-              cmd+=(--tag "{{.GITHUB_NAME}}:${prefix}latest")
+              cmd+=(--tag "{{.GITHUB_NAME}}:latest${suffix}")
             fi
           fi
         fi
diff --git a/pip/aws/requirements.txt b/pip/aws/requirements.txt
index d258618e..671c89e13 100644
--- a/pip/aws/requirements.txt
+++ b/pip/aws/requirements.txt
@@ -1 +1 @@
-boto3==1.43.36
+boto3==1.43.41
diff --git a/tests/aws-azure-gcp.yml b/tests/aws-azure-gcp.yml
index 29082a59..2c4d6710 100644
--- a/tests/aws-azure-gcp.yml
+++ b/tests/aws-azure-gcp.yml
@@ -4,40 +4,32 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: hcledit
     command: bash
-    envVars:
-      - key: EXPECTED_HCLEDIT_VERSION
-        value: ${HCLEDIT_VERSION}
     args:
       - -lc
-      - hcledit version | grep -Eq "^${EXPECTED_HCLEDIT_VERSION}"
+      - hcledit version | grep -Fx '{{HCLEDIT_VERSION}}'
 
   - name: sops
     command: bash
-    envVars:
-      - key: EXPECTED_SOPS_VERSION
-        value: ${SOPS_VERSION}
     args:
       - -lc
-      - sops --version | grep -Eq "^sops ${EXPECTED_SOPS_VERSION}"
+      - sops --version | grep -Fq 'sops {{SOPS_VERSION}}'
 
   - name: TFLint
     command: bash
-    envVars:
-      - key: EXPECTED_TFLINT_VERSION
-        value: ${TFLINT_VERSION}
     args:
       - -lc
-      - tflint --version | grep -Eq "^TFLint version ${EXPECTED_TFLINT_VERSION}"
+      - tflint --version | grep -Fq 'TFLint version {{TFLINT_VERSION}}'
 
   - name: Non-slim tools smoke tests
     command: bash
     args:
       - -lc
       - |
+        set -euo pipefail
         curl --version >/dev/null
         bc --version >/dev/null
         docker --version >/dev/null
@@ -75,14 +67,9 @@ commandTests:
 
   - name: AWS CLI
     command: bash
-    envVars:
-      - key: EXPECTED_AWS_VERSION
-        value: ${AWS_VERSION}
     args:
       - -lc
-      - |
-        aws_minor="$(printf '%s' "${EXPECTED_AWS_VERSION}" | awk -F. '{print $1 "." $2}')"
-        aws --version | grep -Eq "^aws-cli/${aws_minor}"
+      - aws --version | grep -Fq 'aws-cli/{{AWS_VERSION}}'
 
   - name: Boto3 Python module
     command: pip3
@@ -94,9 +81,7 @@ commandTests:
     command: bash
     args:
       - -lc
-      - >-
-        az --version 2>/dev/null |
-        grep -Eq '^azure-cli[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+([[:space:]]+\*)?[[:space:]]*$'
+      - test "$(az version --output json | jq -r '."azure-cli"')" = '{{AZ_VERSION}}'
 
   - name: Google Cloud SDK
     command: bash
@@ -104,7 +89,7 @@ commandTests:
       - -lc
       - >-
         gcloud --version 2>/dev/null |
-        grep -Eq '^Google Cloud SDK[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+[[:space:]]*$'
+        grep -Fx 'Google Cloud SDK {{GCP_VERSION}}'
 
   - name: Temporary and APK cache cleaned
     command: bash
diff --git a/tests/aws-azure.yml b/tests/aws-azure.yml
index 21b4c81c..77754b50 100644
--- a/tests/aws-azure.yml
+++ b/tests/aws-azure.yml
@@ -4,40 +4,32 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: hcledit
     command: bash
-    envVars:
-      - key: EXPECTED_HCLEDIT_VERSION
-        value: ${HCLEDIT_VERSION}
     args:
       - -lc
-      - hcledit version | grep -Eq "^${EXPECTED_HCLEDIT_VERSION}"
+      - hcledit version | grep -Fx '{{HCLEDIT_VERSION}}'
 
   - name: sops
     command: bash
-    envVars:
-      - key: EXPECTED_SOPS_VERSION
-        value: ${SOPS_VERSION}
     args:
       - -lc
-      - sops --version | grep -Eq "^sops ${EXPECTED_SOPS_VERSION}"
+      - sops --version | grep -Fq 'sops {{SOPS_VERSION}}'
 
   - name: TFLint
     command: bash
-    envVars:
-      - key: EXPECTED_TFLINT_VERSION
-        value: ${TFLINT_VERSION}
     args:
       - -lc
-      - tflint --version | grep -Eq "^TFLint version ${EXPECTED_TFLINT_VERSION}"
+      - tflint --version | grep -Fq 'TFLint version {{TFLINT_VERSION}}'
 
   - name: Non-slim tools smoke tests
     command: bash
     args:
       - -lc
       - |
+        set -euo pipefail
         curl --version >/dev/null
         bc --version >/dev/null
         docker --version >/dev/null
@@ -75,14 +67,9 @@ commandTests:
 
   - name: AWS CLI
     command: bash
-    envVars:
-      - key: EXPECTED_AWS_VERSION
-        value: ${AWS_VERSION}
     args:
       - -lc
-      - |
-        aws_minor="$(printf '%s' "${EXPECTED_AWS_VERSION}" | awk -F. '{print $1 "." $2}')"
-        aws --version | grep -Eq "^aws-cli/${aws_minor}"
+      - aws --version | grep -Fq 'aws-cli/{{AWS_VERSION}}'
 
   - name: Boto3 Python module
     command: pip3
@@ -94,9 +81,7 @@ commandTests:
     command: bash
     args:
       - -lc
-      - >-
-        az --version 2>/dev/null |
-        grep -Eq '^azure-cli[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+([[:space:]]+\*)?[[:space:]]*$'
+      - test "$(az version --output json | jq -r '."azure-cli"')" = '{{AZ_VERSION}}'
 
   - name: GCP CLI not installed
     command: bash
diff --git a/tests/aws-gcp.yml b/tests/aws-gcp.yml
index 2c5f1074..c9177fad 100644
--- a/tests/aws-gcp.yml
+++ b/tests/aws-gcp.yml
@@ -4,40 +4,32 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: hcledit
     command: bash
-    envVars:
-      - key: EXPECTED_HCLEDIT_VERSION
-        value: ${HCLEDIT_VERSION}
     args:
       - -lc
-      - hcledit version | grep -Eq "^${EXPECTED_HCLEDIT_VERSION}"
+      - hcledit version | grep -Fx '{{HCLEDIT_VERSION}}'
 
   - name: sops
     command: bash
-    envVars:
-      - key: EXPECTED_SOPS_VERSION
-        value: ${SOPS_VERSION}
     args:
       - -lc
-      - sops --version | grep -Eq "^sops ${EXPECTED_SOPS_VERSION}"
+      - sops --version | grep -Fq 'sops {{SOPS_VERSION}}'
 
   - name: TFLint
     command: bash
-    envVars:
-      - key: EXPECTED_TFLINT_VERSION
-        value: ${TFLINT_VERSION}
     args:
       - -lc
-      - tflint --version | grep -Eq "^TFLint version ${EXPECTED_TFLINT_VERSION}"
+      - tflint --version | grep -Fq 'TFLint version {{TFLINT_VERSION}}'
 
   - name: Non-slim tools smoke tests
     command: bash
     args:
       - -lc
       - |
+        set -euo pipefail
         curl --version >/dev/null
         bc --version >/dev/null
         docker --version >/dev/null
@@ -75,14 +67,9 @@ commandTests:
 
   - name: AWS CLI
     command: bash
-    envVars:
-      - key: EXPECTED_AWS_VERSION
-        value: ${AWS_VERSION}
     args:
       - -lc
-      - |
-        aws_minor="$(printf '%s' "${EXPECTED_AWS_VERSION}" | awk -F. '{print $1 "." $2}')"
-        aws --version | grep -Eq "^aws-cli/${aws_minor}"
+      - aws --version | grep -Fq 'aws-cli/{{AWS_VERSION}}'
 
   - name: Boto3 Python module
     command: pip3
@@ -96,7 +83,7 @@ commandTests:
       - -lc
       - >-
         gcloud --version 2>/dev/null |
-        grep -Eq '^Google Cloud SDK[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+[[:space:]]*$'
+        grep -Fx 'Google Cloud SDK {{GCP_VERSION}}'
 
   - name: Azure CLI not installed
     command: bash
diff --git a/tests/aws.yml b/tests/aws.yml
index e4cbc774..cc5599fb 100644
--- a/tests/aws.yml
+++ b/tests/aws.yml
@@ -4,40 +4,32 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: hcledit
     command: bash
-    envVars:
-      - key: EXPECTED_HCLEDIT_VERSION
-        value: ${HCLEDIT_VERSION}
     args:
       - -lc
-      - hcledit version | grep -Eq "^${EXPECTED_HCLEDIT_VERSION}"
+      - hcledit version | grep -Fx '{{HCLEDIT_VERSION}}'
 
   - name: sops
     command: bash
-    envVars:
-      - key: EXPECTED_SOPS_VERSION
-        value: ${SOPS_VERSION}
     args:
       - -lc
-      - sops --version | grep -Eq "^sops ${EXPECTED_SOPS_VERSION}"
+      - sops --version | grep -Fq 'sops {{SOPS_VERSION}}'
 
   - name: TFLint
     command: bash
-    envVars:
-      - key: EXPECTED_TFLINT_VERSION
-        value: ${TFLINT_VERSION}
     args:
       - -lc
-      - tflint --version | grep -Eq "^TFLint version ${EXPECTED_TFLINT_VERSION}"
+      - tflint --version | grep -Fq 'TFLint version {{TFLINT_VERSION}}'
 
   - name: Non-slim tools smoke tests
     command: bash
     args:
       - -lc
       - |
+        set -euo pipefail
         curl --version >/dev/null
         bc --version >/dev/null
         docker --version >/dev/null
@@ -75,14 +67,9 @@ commandTests:
 
   - name: AWS CLI
     command: bash
-    envVars:
-      - key: EXPECTED_AWS_VERSION
-        value: ${AWS_VERSION}
     args:
       - -lc
-      - |
-        aws_minor="$(printf '%s' "${EXPECTED_AWS_VERSION}" | awk -F. '{print $1 "." $2}')"
-        aws --version | grep -Eq "^aws-cli/${aws_minor}"
+      - aws --version | grep -Fq 'aws-cli/{{AWS_VERSION}}'
 
   - name: Boto3 Python module
     command: pip3
diff --git a/tests/azure-gcp.yml b/tests/azure-gcp.yml
index 8f18d9ff..5e9b3666 100644
--- a/tests/azure-gcp.yml
+++ b/tests/azure-gcp.yml
@@ -4,40 +4,32 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: hcledit
     command: bash
-    envVars:
-      - key: EXPECTED_HCLEDIT_VERSION
-        value: ${HCLEDIT_VERSION}
     args:
       - -lc
-      - hcledit version | grep -Eq "^${EXPECTED_HCLEDIT_VERSION}"
+      - hcledit version | grep -Fx '{{HCLEDIT_VERSION}}'
 
   - name: sops
     command: bash
-    envVars:
-      - key: EXPECTED_SOPS_VERSION
-        value: ${SOPS_VERSION}
     args:
       - -lc
-      - sops --version | grep -Eq "^sops ${EXPECTED_SOPS_VERSION}"
+      - sops --version | grep -Fq 'sops {{SOPS_VERSION}}'
 
   - name: TFLint
     command: bash
-    envVars:
-      - key: EXPECTED_TFLINT_VERSION
-        value: ${TFLINT_VERSION}
     args:
       - -lc
-      - tflint --version | grep -Eq "^TFLint version ${EXPECTED_TFLINT_VERSION}"
+      - tflint --version | grep -Fq 'TFLint version {{TFLINT_VERSION}}'
 
   - name: Non-slim tools smoke tests
     command: bash
     args:
       - -lc
       - |
+        set -euo pipefail
         curl --version >/dev/null
         bc --version >/dev/null
         docker --version >/dev/null
@@ -77,9 +69,7 @@ commandTests:
     command: bash
     args:
       - -lc
-      - >-
-        az --version 2>/dev/null |
-        grep -Eq '^azure-cli[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+([[:space:]]+\*)?[[:space:]]*$'
+      - test "$(az version --output json | jq -r '."azure-cli"')" = '{{AZ_VERSION}}'
 
   - name: Google Cloud SDK
     command: bash
@@ -87,7 +77,7 @@ commandTests:
       - -lc
       - >-
         gcloud --version 2>/dev/null |
-        grep -Eq '^Google Cloud SDK[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+[[:space:]]*$'
+        grep -Fx 'Google Cloud SDK {{GCP_VERSION}}'
 
   - name: AWS CLI not installed
     command: bash
diff --git a/tests/azure.yml b/tests/azure.yml
index a0a957f0..1b353351 100644
--- a/tests/azure.yml
+++ b/tests/azure.yml
@@ -4,40 +4,32 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: hcledit
     command: bash
-    envVars:
-      - key: EXPECTED_HCLEDIT_VERSION
-        value: ${HCLEDIT_VERSION}
     args:
       - -lc
-      - hcledit version | grep -Eq "^${EXPECTED_HCLEDIT_VERSION}"
+      - hcledit version | grep -Fx '{{HCLEDIT_VERSION}}'
 
   - name: sops
     command: bash
-    envVars:
-      - key: EXPECTED_SOPS_VERSION
-        value: ${SOPS_VERSION}
     args:
       - -lc
-      - sops --version | grep -Eq "^sops ${EXPECTED_SOPS_VERSION}"
+      - sops --version | grep -Fq 'sops {{SOPS_VERSION}}'
 
   - name: TFLint
     command: bash
-    envVars:
-      - key: EXPECTED_TFLINT_VERSION
-        value: ${TFLINT_VERSION}
     args:
       - -lc
-      - tflint --version | grep -Eq "^TFLint version ${EXPECTED_TFLINT_VERSION}"
+      - tflint --version | grep -Fq 'TFLint version {{TFLINT_VERSION}}'
 
   - name: Non-slim tools smoke tests
     command: bash
     args:
       - -lc
       - |
+        set -euo pipefail
         curl --version >/dev/null
         bc --version >/dev/null
         docker --version >/dev/null
@@ -77,9 +69,7 @@ commandTests:
     command: bash
     args:
       - -lc
-      - >-
-        az --version 2>/dev/null |
-        grep -Eq '^azure-cli[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+([[:space:]]+\*)?[[:space:]]*$'
+      - test "$(az version --output json | jq -r '."azure-cli"')" = '{{AZ_VERSION}}'
 
   - name: AWS and GCP CLIs not installed
     command: bash
diff --git a/tests/gcp.yml b/tests/gcp.yml
index db525080..c935abb1 100644
--- a/tests/gcp.yml
+++ b/tests/gcp.yml
@@ -4,40 +4,32 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: hcledit
     command: bash
-    envVars:
-      - key: EXPECTED_HCLEDIT_VERSION
-        value: ${HCLEDIT_VERSION}
     args:
       - -lc
-      - hcledit version | grep -Eq "^${EXPECTED_HCLEDIT_VERSION}"
+      - hcledit version | grep -Fx '{{HCLEDIT_VERSION}}'
 
   - name: sops
     command: bash
-    envVars:
-      - key: EXPECTED_SOPS_VERSION
-        value: ${SOPS_VERSION}
     args:
       - -lc
-      - sops --version | grep -Eq "^sops ${EXPECTED_SOPS_VERSION}"
+      - sops --version | grep -Fq 'sops {{SOPS_VERSION}}'
 
   - name: TFLint
     command: bash
-    envVars:
-      - key: EXPECTED_TFLINT_VERSION
-        value: ${TFLINT_VERSION}
     args:
       - -lc
-      - tflint --version | grep -Eq "^TFLint version ${EXPECTED_TFLINT_VERSION}"
+      - tflint --version | grep -Fq 'TFLint version {{TFLINT_VERSION}}'
 
   - name: Non-slim tools smoke tests
     command: bash
     args:
       - -lc
       - |
+        set -euo pipefail
         curl --version >/dev/null
         bc --version >/dev/null
         docker --version >/dev/null
@@ -79,7 +71,7 @@ commandTests:
       - -lc
       - >-
         gcloud --version 2>/dev/null |
-        grep -Eq '^Google Cloud SDK[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+[[:space:]]*$'
+        grep -Fx 'Google Cloud SDK {{GCP_VERSION}}'
 
   - name: AWS and Azure CLIs not installed
     command: bash
diff --git a/tests/ot.yml b/tests/ot.yml
index 57d3da67..8d67496c 100644
--- a/tests/ot.yml
+++ b/tests/ot.yml
@@ -5,13 +5,13 @@ commandTests:
     command: bash
     args:
       - -lc
-      - tofu --version | grep -Eq "^OpenTofu v${OT_VERSION}"
+      - tofu --version | grep -Fq 'OpenTofu v{{OT_VERSION}}'
 
   - name: Terragrunt
     command: bash
     args:
       - -lc
-      - terragrunt --version | grep -Eq "^terragrunt version v${TG_VERSION}"
+      - terragrunt --version | grep -Fq 'terragrunt version v{{TG_VERSION}}'
 
   - name: Terraform not installed
     command: bash
diff --git a/tests/plain.yml b/tests/plain.yml
index 417fe087..62acfe3c 100644
--- a/tests/plain.yml
+++ b/tests/plain.yml
@@ -4,40 +4,32 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: hcledit
     command: bash
-    envVars:
-      - key: EXPECTED_HCLEDIT_VERSION
-        value: ${HCLEDIT_VERSION}
     args:
       - -lc
-      - hcledit version | grep -Eq "^${EXPECTED_HCLEDIT_VERSION}"
+      - hcledit version | grep -Fx '{{HCLEDIT_VERSION}}'
 
   - name: sops
     command: bash
-    envVars:
-      - key: EXPECTED_SOPS_VERSION
-        value: ${SOPS_VERSION}
     args:
       - -lc
-      - sops --version | grep -Eq "^sops ${EXPECTED_SOPS_VERSION}"
+      - sops --version | grep -Fq 'sops {{SOPS_VERSION}}'
 
   - name: TFLint
     command: bash
-    envVars:
-      - key: EXPECTED_TFLINT_VERSION
-        value: ${TFLINT_VERSION}
     args:
       - -lc
-      - tflint --version | grep -Eq "^TFLint version ${EXPECTED_TFLINT_VERSION}"
+      - tflint --version | grep -Fq 'TFLint version {{TFLINT_VERSION}}'
 
   - name: Non-slim tools smoke tests
     command: bash
     args:
       - -lc
       - |
+        set -euo pipefail
         curl --version >/dev/null
         bc --version >/dev/null
         docker --version >/dev/null
diff --git a/tests/slim.yml b/tests/slim.yml
index 05a4d5c1..20a03ac4 100644
--- a/tests/slim.yml
+++ b/tests/slim.yml
@@ -4,7 +4,7 @@ commandTests:
   - name: Alpine version
     command: cat
     args: [/etc/os-release]
-    expectedOutput: [VERSION_ID=3\.24]
+    expectedOutput: [VERSION_ID=3\.24\.1]
 
   - name: Slim tools smoke tests
     command: bash
diff --git a/tests/tf.yml b/tests/tf.yml
index bf91ece2..1df636ba 100644
--- a/tests/tf.yml
+++ b/tests/tf.yml
@@ -5,13 +5,13 @@ commandTests:
     command: bash
     args:
       - -lc
-      - terraform --version | grep -Eq "^Terraform v${TF_VERSION}"
+      - terraform --version | grep -Fq 'Terraform v{{TF_VERSION}}'
 
   - name: Terragrunt
     command: bash
     args:
       - -lc
-      - terragrunt --version | grep -Eq "^terragrunt version v${TG_VERSION}"
+      - terragrunt --version | grep -Fq 'terragrunt version v{{TG_VERSION}}'
 
   - name: OpenTofu not installed
     command: bash