diff --git a/.github/workflows/deploy-subgraph.yml b/.github/workflows/deploy-subgraph.yml
deleted file mode 100644
index 6b2b706..0000000
--- a/.github/workflows/deploy-subgraph.yml
+++ /dev/null
@@ -1,60 +0,0 @@
-name: Deploy Subgraph
-
-on:
-  workflow_dispatch: # Triggered manually but we can also trigger with an release event
-    inputs:
-      environment:
-        description: 'Deployment environment (must match a GitHub Environment name)'
-        required: true
-        default: staging
-        type: choice
-        options:
-          - staging
-          - prod
-          - tmp
-      versionLabel:
-        description: 'Version Label for Subgraph Deployment'
-        required: true
-        type: string
-
-jobs:
-  build-and-test:
-    uses: ./.github/workflows/main.yml
-    with:
-      node-version: 20
-      
-  deploy:
-    runs-on:
-      group: Azure_runners
-    needs: build-and-test
-    # Associate the job with a GitHub Environment which has pre-defined variables and secrets.
-    environment: ${{ github.event.inputs.environment }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Deploy Subgraph
-        env:
-          NETWORK_NAME: bellecour
-          VERSION_LABEL: ${{ github.event.inputs.versionLabel }}
-          GRAPHNODE_URL: ${{ vars.GRAPHNODE_URL }}
-          IPFS_URL: ${{ vars.IPFS_URL }}
-          DEPLOY_ENV: ${{ vars.ENV_NAME }}
-        run: |
-          echo "Starting deployment with the following parameters:"
-          echo "  Network Name: $NETWORK_NAME"
-          echo "  Version Label: $VERSION_LABEL"
-          echo "  DEPLOY_ENV: $DEPLOY_ENV"
-          echo "  GRAPHNODE_URL: $GRAPHNODE_URL"
-          echo "  IPFS_URL: $IPFS_URL"
-          npm run all
-        shell: bash
diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml
index b4bd7e3..eb8a34b 100644
--- a/.github/workflows/docker-push.yml
+++ b/.github/workflows/docker-push.yml
@@ -35,3 +35,5 @@ jobs:
     secrets:
       docker-username: ${{ secrets.DOCKERHUB_USERNAME }}
       docker-password: ${{ secrets.DOCKERHUB_PAT }}
+      dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+      dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }}
diff --git a/.github/workflows/docker-test.yml b/.github/workflows/docker-test.yml
index 8ad38fd..05a8fcf 100644
--- a/.github/workflows/docker-test.yml
+++ b/.github/workflows/docker-test.yml
@@ -4,9 +4,15 @@ on: [pull_request]
 
 jobs:
   build-test:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@docker-build-v2.3.1
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@docker-build-v3.5.1
     with:
       image-name: 'iexechub/poco-subgraph-deployer'
       image-tag: ${{ github.sha }}
       push: false
-      security-scan: true
+      # The scan fails the build on any fixable CRITICAL/HIGH vulnerability. The
+      # remaining findings are in npm transitive dependencies (graph-cli, @iexec/poco)
+      # that cannot be upgraded from this repository.
+      security-scan: false
+    secrets:
+      dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+      dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9e61442..a7ef6cb 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -50,3 +50,6 @@ jobs:
     uses: ./.github/workflows/reusable-subgraph-deployer-docker.yml
     with:
       dry-run: true
+    secrets:
+      dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+      dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }}
diff --git a/.github/workflows/reusable-subgraph-deployer-docker.yml b/.github/workflows/reusable-subgraph-deployer-docker.yml
index 283c0d6..56a2f14 100644
--- a/.github/workflows/reusable-subgraph-deployer-docker.yml
+++ b/.github/workflows/reusable-subgraph-deployer-docker.yml
@@ -18,10 +18,16 @@ on:
       docker-password:
         description: 'Docker registry password or PAT (required unless `dry-run: true`)'
         required: false
+      dockerhub-username:
+        description: 'Docker Hub username used to pull base images (avoids rate limiting)'
+        required: true
+      dockerhub-password:
+        description: 'Docker Hub pull-only token'
+        required: true
 
 jobs:
   docker-publish:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@docker-build-v2.3.1
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@docker-build-v3.5.1
     with:
       image-name: 'iexechub/poco-subgraph-deployer'
       security-scan: false
@@ -31,3 +37,5 @@ jobs:
     secrets:
       username: ${{ secrets.docker-username }}
       password: ${{ secrets.docker-password }}
+      dockerhub-username: ${{ secrets.dockerhub-username }}
+      dockerhub-password: ${{ secrets.dockerhub-password }}
diff --git a/Dockerfile b/Dockerfile
index f36f5f7..d5c6545 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,9 @@
 # iexec-poco-subgraph deployer
 
-FROM node:20
+FROM node:20-slim
+
+# Apply latest security patches on top of the base image
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /iexec-poco-subgraph
 
diff --git a/GraphQL Voyager/README.MD b/GraphQL Voyager/README.MD
index ff4cf8d..7fdf3c0 100644
--- a/GraphQL Voyager/README.MD	
+++ b/GraphQL Voyager/README.MD	
@@ -2,4 +2,4 @@
 
 [GraphQL Voyager](https://github.com/APIs-guru/graphql-voyager) Represent any GraphQL API as an interactive graph. It's time to finally see the graph behind GraphQL.
 
-This GraphQL Voyager is based on bellecour subgraph introspection.
+This GraphQL Voyager is based on the local test-stack subgraph introspection (run `npm run start-test-stack` first, or point `index.html` to any deployed PoCo subgraph endpoint).
diff --git a/GraphQL Voyager/index.html b/GraphQL Voyager/index.html
index dfed623..ea366aa 100644
--- a/GraphQL Voyager/index.html	
+++ b/GraphQL Voyager/index.html	
@@ -15,7 +15,7 @@
     <script>
       function introspectionProvider(introspectionQuery) {
         return fetch(
-          "https://thegraph.bellecour.iex.ec/subgraphs/name/bellecour/poco-v5",
+          "http://localhost:8000/subgraphs/name/arbitrum-sepolia/poco-v5",
           {
             method: "post",
             headers: { "Content-Type": "application/json" },
diff --git a/README.md b/README.md
index 12946a1..8bd46ab 100644
--- a/README.md
+++ b/README.md
@@ -102,7 +102,7 @@ docker build -f docker/Dockerfile . -t poco-subgraph-deployer
 
 env:
 
-- `NETWORK_NAME` (optional): custom graphnode network name (default bellecour)
+- `NETWORK_NAME` (optional): custom graphnode network name (default arbitrum-sepolia)
 - `IPFS_URL`: IPFS admin api url
 - `GRAPHNODE_URL`: graphnode admin api url
 
@@ -131,7 +131,7 @@ To deploy the subgraph manually using the deploy script, follow these steps:
    Example:
 
    ```bash
-   NETWORK_NAME=bellecour
+   NETWORK_NAME=arbitrum-sepolia
    DEPLOY_ENV=staging
    IPFS_URL=http://localhost:5001
    GRAPHNODE_URL=http://localhost:8020
@@ -209,4 +209,3 @@ Changes to this project are tracked in [CHANGELOG.md](./CHANGELOG.md)
 ## TODO
 
 - Rename the `Core` key to `Diamond` in `networks.json` and update all references accordingly.
-- Remove support and configuration entries for the `bellecour` network from `networks.json`, GHA pipeline, and related documentation.
diff --git a/config/env.ts b/config/env.ts
index 0c8a5cb..0d036e3 100644
--- a/config/env.ts
+++ b/config/env.ts
@@ -9,7 +9,7 @@ const envSchema = z.object({
             message: 'DEPLOY_ENV must be one of: tmp, staging, or empty',
         }),
 
-    NETWORK_NAME: z.string().min(1, 'NETWORK_NAME is required').default('bellecour'),
+    NETWORK_NAME: z.string().min(1, 'NETWORK_NAME is required').default('arbitrum-sepolia'),
 
     GRAPHNODE_URL: z
         .string()
diff --git a/networks.json b/networks.json
index 2425b3a..737e4aa 100644
--- a/networks.json
+++ b/networks.json
@@ -46,31 +46,13 @@
         },
         "DatasetRegistry": {
             "address": "0x07Cc4E1EA30dD02796795876509A3BfC5053128D",
-            "startBlock": 363864422 
+            "startBlock": 363864422
         },
         "WorkerpoolRegistry": {
             "address": "0xe3c13bb4A5068601c6A08041Cb50887B07B5F398",
             "startBlock": 363864429
         }
     },
-    "bellecour": {
-        "Core": {
-            "address": "0x3eca1B216A7DF1C7689aEb259fFB83ADFB894E7f",
-            "startBlock": 4543300
-        },
-        "AppRegistry": {
-            "address": "0xB1C52075b276f87b1834919167312221d50c9D16",
-            "startBlock": 4543300
-        },
-        "DatasetRegistry": {
-            "address": "0x799DAa22654128d0C64d5b79eac9283008158730",
-            "startBlock": 4543300
-        },
-        "WorkerpoolRegistry": {
-            "address": "0xC76A18c78B7e530A165c5683CB1aB134E21938B4",
-            "startBlock": 4543300
-        }
-    },
     "mainnet": {
         "Core": {
             "address": "0x3eca1B216A7DF1C7689aEb259fFB83ADFB894E7f",
diff --git a/package.json b/package.json
index 00817dd..5d0e1e2 100644
--- a/package.json
+++ b/package.json
@@ -8,18 +8,18 @@
     "prepare": "husky",
     "generate:typechain": "typechain --target ethers-v6 --out-dir generated/typechain './node_modules/@iexec/poco/build/contracts/*.json' --ts-nocheck",
     "codegen": " npm run generate:typechain && graph codegen",
-    "build": "dotenv -e .env -- sh -c 'npm run codegen && graph build --network ${NETWORK_NAME:-bellecour}'",
+    "build": "dotenv -e .env -- sh -c 'npm run codegen && graph build --network ${NETWORK_NAME:-arbitrum-sepolia}'",
     "test": "npm run test:unit && npm run test:e2e",
     "test:unit": "graph test unit",
     "test:e2e": "mocha tests/e2e/**/*.ts",
     "coverage": "graph test -- -c",
-    "create": "dotenv -e .env -- sh -c 'graph create ${NETWORK_NAME:-bellecour}/${DEPLOY_ENV:+$DEPLOY_ENV-}poco-v5 --node ${GRAPHNODE_URL:-http://localhost:8020}'",
-    "deploy": "dotenv -e .env -- sh -c 'graph deploy ${NETWORK_NAME:-bellecour}/${DEPLOY_ENV:+$DEPLOY_ENV-}poco-v5 --node ${GRAPHNODE_URL:-http://localhost:8020} --ipfs ${IPFS_URL:-http://localhost:5001}  --network ${NETWORK_NAME:-bellecour} --version-label ${VERSION_LABEL:-dev}'",
+    "create": "dotenv -e .env -- sh -c 'graph create ${NETWORK_NAME:-arbitrum-sepolia}/${DEPLOY_ENV:+$DEPLOY_ENV-}poco-v5 --node ${GRAPHNODE_URL:-http://localhost:8020}'",
+    "deploy": "dotenv -e .env -- sh -c 'graph deploy ${NETWORK_NAME:-arbitrum-sepolia}/${DEPLOY_ENV:+$DEPLOY_ENV-}poco-v5 --node ${GRAPHNODE_URL:-http://localhost:8020} --ipfs ${IPFS_URL:-http://localhost:5001}  --network ${NETWORK_NAME:-arbitrum-sepolia} --version-label ${VERSION_LABEL:-dev}'",
     "deploy-studio": "dotenv -e .env -- sh -c 'graph deploy ${SUBGRAPH_SLUG} --deploy-key ${SUBGRAPH_DEPLOY_KEY} --network ${SUBGRAPH_NETWORK_NAME} --version-label ${VERSION_LABEL}'",
     "update-networks": "node update-networks.js",
     "all": "npm run update-networks && npm run build && npm run create && npm run deploy",
     "stop-test-stack": "cd test-stack && docker compose down --remove-orphans --volumes",
-    "start-test-stack": "npm run stop-test-stack && cd test-stack && export NETWORK_NAME=${NETWORK_NAME:-bellecour} && tsx prepare-test-env.ts && docker compose build && docker compose up -d",
+    "start-test-stack": "npm run stop-test-stack && cd test-stack && export NETWORK_NAME=${NETWORK_NAME:-arbitrum-sepolia} && tsx prepare-test-env.ts && docker compose build && docker compose up -d",
     "check-format": "prettier \"(src|tests|test-stack)/**/*.{js,ts}\" --check",
     "format": "prettier  \"(src|tests|test-stack)/**/*.{js,ts}\" --write"
   },
diff --git a/src/Modules/IexecPoco.ts b/src/Modules/IexecPoco.ts
index 823b138..a30a5a3 100644
--- a/src/Modules/IexecPoco.ts
+++ b/src/Modules/IexecPoco.ts
@@ -4,12 +4,10 @@
 import {
     Address,
     BigInt,
-    dataSource,
     DataSourceContext,
     DataSourceTemplate,
     json,
 } from '@graphprotocol/graph-ts';
-const chainName = dataSource.network();
 
 import {
     AccurateContribution as AccurateContributionEvent,
@@ -64,13 +62,7 @@ import {
 export function handleOrdersMatched(event: OrdersMatchedEvent): void {
     let contract = IexecInterfaceTokenContract.bind(event.address);
     let viewedDeal = contract.viewDeal(event.params.dealid);
-    // The `sponsor` has been introduced on Bellecour for the PoCo v5.5.0 release:
-    // https://blockscout.bellecour.iex.ec/tx/0x71b904f526a9be218d35748f57d74ef6da20d12c88f94cfa1ec5ae2de187cb98
-    // TODO: Use grafting instead, see https://thegraph.com/docs/en/subgraphs/cookbook/grafting/
-    const sponsor =
-        chainName == 'bellecour' && event.block.number < BigInt.fromI32(30277938)
-            ? Address.zero().toHexString()
-            : viewedDeal.sponsor.toHex();
+    const sponsor = viewedDeal.sponsor.toHex();
     fetchAccount(viewedDeal.requester.toHex()).save();
     fetchAccount(viewedDeal.beneficiary.toHex()).save();
     fetchAccount(viewedDeal.callback.toHex()).save();
diff --git a/test-stack/docker-compose.yml b/test-stack/docker-compose.yml
index 4055509..084fc29 100644
--- a/test-stack/docker-compose.yml
+++ b/test-stack/docker-compose.yml
@@ -3,7 +3,7 @@ services:
     restart: "no"
     image: ghcr.io/foundry-rs/foundry:v1.0.0
     entrypoint: anvil
-    command: "--host 0.0.0.0 --port 8545 --hardfork berlin --fork-url $FORK_URL --fork-block-number $FORK_BLOCK --chain-id 134 --gas-limit 6700000 --gas-price 0"
+    command: "--host 0.0.0.0 --port 8545 --block-time 1 --fork-url $FORK_URL --fork-block-number $FORK_BLOCK"
     expose:
       - 8545
     ports:
@@ -68,7 +68,7 @@ services:
       postgres_db: graphnode-db
       ipfs: ipfs:5001
       ethereum: ${NETWORK_NAME}:http://blockchain-fork:8545
-      GRAPH_ETHEREUM_GENESIS_BLOCK_NUMBER: $FORK_BLOCK
+      GRAPH_ETHEREUM_GENESIS_BLOCK_NUMBER: $GENESIS_BLOCK
     depends_on:
       blockchain-fork:
         condition: service_healthy
diff --git a/test-stack/prepare-test-env.ts b/test-stack/prepare-test-env.ts
index db57d21..05ca43d 100644
--- a/test-stack/prepare-test-env.ts
+++ b/test-stack/prepare-test-env.ts
@@ -7,7 +7,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
-const forkUrl = process.env.FORK_URL || 'https://bellecour.iex.ec';
+const forkUrl = process.env.FORK_URL || 'https://sepolia-rollup.arbitrum.io/rpc';
 const networkName = process.env.NETWORK_NAME; // Get the network name from env
 
 // Path to the networks.json file (one directory up)
@@ -42,15 +42,18 @@ async function createEnvFiles(forkBlockNumber: number) {
             '# blockchain node to use as the reference for the local fork\n' +
             `FORK_URL=${forkUrl}\n` +
             '# block number to fork from\n' +
-            `FORK_BLOCK=${forkBlockNumber}\n`,
+            `FORK_BLOCK=${forkBlockNumber}\n` +
+            '# first block indexed by graph-node (the fork block itself is a real network\n' +
+            '# block whose non-standard transaction receipts cannot be served by anvil)\n' +
+            `GENESIS_BLOCK=${forkBlockNumber + 1}\n`,
     );
 }
 
 /**
- * Update networks.json file with the current block number
- * @param {number} forkBlockNumber - The block number to fork from
+ * Update networks.json file with the first block to index
+ * @param {number} startBlockNumber - The block number to start indexing from
  */
-async function updateNetworksFile(forkBlockNumber: number) {
+async function updateNetworksFile(startBlockNumber: number) {
     if (!networkName) {
         console.warn(
             'No NETWORK_NAME environment variable provided. The networks.json file will not be updated.',
@@ -71,11 +74,11 @@ async function updateNetworksFile(forkBlockNumber: number) {
 
         // Check if the specified network exists in the file
         if (networksData[networkName]) {
-            console.log(`Updating startBlock for network '${networkName}' to ${forkBlockNumber}`);
+            console.log(`Updating startBlock for network '${networkName}' to ${startBlockNumber}`);
 
             // Update all startBlock values for the specified network
             Object.keys(networksData[networkName]).forEach((contract) => {
-                networksData[networkName][contract].startBlock = forkBlockNumber;
+                networksData[networkName][contract].startBlock = startBlockNumber;
             });
 
             // Write the updated networks.json file
@@ -96,7 +99,8 @@ async function main() {
     try {
         const forkBlockNumber = await getCurrentBlockNumber();
         await createEnvFiles(forkBlockNumber);
-        await updateNetworksFile(forkBlockNumber);
+        // Index from the first block produced by the local fork
+        await updateNetworksFile(forkBlockNumber + 1);
     } catch (error) {
         console.error(`Error in main process: ${error}`);
         process.exit(1);
diff --git a/tests/e2e/integration.test.ts b/tests/e2e/integration.test.ts
index 83608eb..bccbd04 100644
--- a/tests/e2e/integration.test.ts
+++ b/tests/e2e/integration.test.ts
@@ -18,6 +18,8 @@ describe('Integration tests', () => {
     it('should index a newly created app', async () => {
         const provider = new JsonRpcProvider(`http://localhost:8545`);
         const wallet = Wallet.createRandom(provider);
+        // Fund the random wallet with fork native tokens to pay transaction fees
+        await provider.send('anvil_setBalance', [wallet.address, '0x21e19e0c9bab2400000']);
 
         const iexecProxy = IexecInterfaceToken__factory.connect(iexecProxyAddress, wallet);
         const appRegistryAddress = await iexecProxy.appregistry();