diff --git a/.gitignore b/.gitignore
index 3f15512..0efe175 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,9 @@
 .envrc
 /inventory.yaml
 /spec/fixtures/litmus_inventory.yaml
+.resource_types
+.modules
+.task_cache.json
+.plan_cache.json
+.rerun.json
+bolt-debug.log
diff --git a/.pdkignore b/.pdkignore
index 862847a..9403b08 100644
--- a/.pdkignore
+++ b/.pdkignore
@@ -26,6 +26,12 @@
 .envrc
 /inventory.yaml
 /spec/fixtures/litmus_inventory.yaml
+.resource_types
+.modules
+.task_cache.json
+.plan_cache.json
+.rerun.json
+bolt-debug.log
 /.fixtures.yml
 /Gemfile
 /.gitattributes
diff --git a/.rubocop.yml b/.rubocop.yml
index 5be1f9f..21b82b9 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -3,6 +3,7 @@ require:
 - rubocop-performance
 - rubocop-rspec
 AllCops:
+  NewCops: enable
   DisplayCopNames: true
   TargetRubyVersion: '2.6'
   Include:
@@ -527,6 +528,8 @@ Lint/DuplicateBranch:
   Enabled: false
 Lint/DuplicateMagicComment:
   Enabled: false
+Lint/DuplicateMatchPattern:
+  Enabled: false
 Lint/DuplicateRegexpCharacterClassElement:
   Enabled: false
 Lint/EmptyBlock:
@@ -643,6 +646,8 @@ Style/ComparableClamp:
   Enabled: false
 Style/ConcatArrayLiterals:
   Enabled: false
+Style/DataInheritance:
+  Enabled: false
 Style/DirEmpty:
   Enabled: false
 Style/DocumentDynamicEvalDefinition:
@@ -711,6 +716,8 @@ Style/RedundantHeredocDelimiterQuotes:
   Enabled: false
 Style/RedundantInitialize:
   Enabled: false
+Style/RedundantLineContinuation:
+  Enabled: false
 Style/RedundantSelfAssignmentBranch:
   Enabled: false
 Style/RedundantStringEscape:
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
index 2f1e4f7..6da8d47 100644
--- a/.vscode/extensions.json
+++ b/.vscode/extensions.json
@@ -1,6 +1,6 @@
 {
   "recommendations": [
     "puppet.puppet-vscode",
-    "rebornix.Ruby"
+    "Shopify.ruby-lsp"
   ]
 }
diff --git a/Gemfile b/Gemfile
index ca0e773..197de74 100644
--- a/Gemfile
+++ b/Gemfile
@@ -20,30 +20,30 @@ group :development do
   gem "json", '= 2.6.1',                         require: false if Gem::Requirement.create(['>= 3.1.0', '< 3.1.3']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "json", '= 2.6.3',                         require: false if Gem::Requirement.create(['>= 3.2.0', '< 4.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "racc", '~> 1.4.0',                        require: false if Gem::Requirement.create(['>= 2.7.0', '< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
+  gem "deep_merge", '~> 1.2.2',                  require: false
   gem "voxpupuli-puppet-lint-plugins", '~> 5.0', require: false
-  gem "facterdb", '~> 1.18',                     require: false
-  gem "metadata-json-lint", '~> 3.0',            require: false
-  gem "puppetlabs_spec_helper", '~> 6.0',        require: false
-  gem "rspec-puppet-facts", '~> 2.0',            require: false
-  gem "codecov", '~> 0.2',                       require: false
+  gem "facterdb", '~> 1.26',                     require: false
+  gem "metadata-json-lint", '~> 4.0',            require: false
+  gem "rspec-puppet-facts", '~> 3.0',            require: false
   gem "dependency_checker", '~> 1.0.0',          require: false
   gem "parallel_tests", '= 3.12.1',              require: false
   gem "pry", '~> 0.10',                          require: false
-  gem "simplecov-console", '~> 0.5',             require: false
+  gem "simplecov-console", '~> 0.9',             require: false
   gem "puppet-debugger", '~> 1.0',               require: false
-  gem "rubocop", '= 1.48.1',                     require: false
+  gem "rubocop", '~> 1.50.0',                    require: false
   gem "rubocop-performance", '= 1.16.0',         require: false
   gem "rubocop-rspec", '= 2.19.0',               require: false
-  gem "puppet-strings", '~> 4.0',                require: false
   gem "rb-readline", '= 0.5.5',                  require: false, platforms: [:mswin, :mingw, :x64_mingw]
+  gem "rexml", '>= 3.0.0', '< 3.2.7',            require: false
 end
-group :system_tests do
-  gem "puppet_litmus", '~> 1.0', require: false, platforms: [:ruby, :x64_mingw]
-  gem "serverspec", '~> 2.41',   require: false
-end
-group :release_prep do
+group :development, :release_prep do
   gem "puppet-strings", '~> 4.0',         require: false
-  gem "puppetlabs_spec_helper", '~> 6.0', require: false
+  gem "puppetlabs_spec_helper", '~> 7.0', require: false
+end
+group :system_tests do
+  gem "puppet_litmus", '~> 1.0',   require: false, platforms: [:ruby, :x64_mingw]
+  gem "CFPropertyList", '< 3.0.7', require: false, platforms: [:mswin, :mingw, :x64_mingw]
+  gem "serverspec", '~> 2.41',     require: false
 end
 
 puppet_version = ENV['PUPPET_GEM_VERSION']
diff --git a/manifests/certificate.pp b/manifests/certificate.pp
index 888309d..dae08b6 100644
--- a/manifests/certificate.pp
+++ b/manifests/certificate.pp
@@ -51,7 +51,7 @@
 
   $path = $acme::path
 
-  if $domain == undef {
+  if $domain =~ Undef {
     # compatibility mode, parse name as list of domains, and use first as certificate resource name
     $domains = split(downcase($name), ' ')
     $cert_name = $domains[0]
diff --git a/metadata.json b/metadata.json
index 091408a..4ac9583 100644
--- a/metadata.json
+++ b/metadata.json
@@ -79,7 +79,7 @@
     "ssl",
     "certificate"
   ],
-  "pdk-version": "3.0.1",
+  "pdk-version": "3.2.0",
   "template-url": "https://github.com/markt-de/pdk-templates.git#main",
-  "template-ref": "heads/main-0-g909fd77"
+  "template-ref": "heads/main-0-g1829b3f"
 }
diff --git a/spec/classes/acme_spec.rb b/spec/classes/acme_spec.rb
index 1bf3e6f..7ebd078 100644
--- a/spec/classes/acme_spec.rb
+++ b/spec/classes/acme_spec.rb
@@ -10,8 +10,8 @@
 
         context 'with example configuration' do
           let(:facts) do
-            super().merge(
-              'openssl_version' => '1.0.2k-fips',
+            super().deep_merge!(
+              openssl_version: '1.0.2k-fips',
             )
           end
           let(:params) do
@@ -49,6 +49,10 @@
           it { is_expected.to compile.with_all_deps }
           it { is_expected.to contain_class('acme') }
 
+          # rubocop:disable all
+          it { is_expected.to contain_class("facts: %s" % facts) }
+          # rubocop:enable all
+
           it { is_expected.not_to contain_class('acme::setup::puppetmaster') }
           it { is_expected.not_to contain_class('acme::request::handler') }
           it { is_expected.not_to contain_class('acme::request::crt') }
@@ -71,13 +75,11 @@
           le_profile = 'nsupdate_example'
 
           let(:facts) do
-            super().merge(
-              'fqdn' => test_host,
-              'networking' => {
+            super().deep_merge!(
+              networking: {
                 'fqdn' => test_host,
               },
-              'servername' => test_host,
-              'openssl_version' => '1.0.2k-fips',
+              openssl_version: '1.0.2k-fips',
             )
           end
           let(:params) do
@@ -134,13 +136,11 @@
           le_ca = 'zerossl'
 
           let(:facts) do
-            super().merge(
-              'fqdn' => test_host,
-              'networking' => {
+            super().deep_merge!(
+              networking: {
                 'fqdn' => test_host,
               },
-              'servername' => test_host,
-              'openssl_version' => '1.0.2k-fips',
+              openssl_version: '1.0.2k-fips',
             )
           end
           let(:params) do
diff --git a/spec/default_facts.yml b/spec/default_facts.yml
index 3346c39..9f172f0 100644
--- a/spec/default_facts.yml
+++ b/spec/default_facts.yml
@@ -2,8 +2,4 @@
 #
 # Facts specified here will override the values provided by rspec-puppet-facts.
 ---
-networking:
-  ip: "172.16.254.254"
-  ip6: "FE80:0000:0000:0000:AAAA:AAAA:AAAA"
-  mac: "AA:AA:AA:AA:AA:AA"
 is_pe: false
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 6820ceb..ae7c1f6 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -25,7 +25,8 @@
   next unless File.exist?(f) && File.readable?(f) && File.size?(f)
 
   begin
-    default_facts.merge!(YAML.safe_load(File.read(f), permitted_classes: [], permitted_symbols: [], aliases: true))
+    require 'deep_merge'
+    default_facts.deep_merge!(YAML.safe_load(File.read(f), permitted_classes: [], permitted_symbols: [], aliases: true))
   rescue StandardError => e
     RSpec.configuration.reporter.message "WARNING: Unable to load #{f}: #{e}"
   end
@@ -33,7 +34,7 @@
 
 # read default_facts and merge them over what is provided by facterdb
 default_facts.each do |fact, value|
-  add_custom_fact fact, value
+  add_custom_fact fact, value, merge_facts: true
 end
 
 RSpec.configure do |c|