diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 53ac578d..b27b0680 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,5 @@
 ---
-name: Dokken Integration Tests
+name: ci
 
 "on":
   pull_request:
@@ -15,138 +15,118 @@ jobs:
       pull-requests: write
       statuses: write
       issues: write
+    secrets: inherit
 
   integration:
     needs: lint-unit
     runs-on: ubuntu-latest
     strategy:
-      matrix:
-        os:
-          - "debian-11"
-          - "debian-12"
-          - "ubuntu-2004"
-          - "ubuntu-2204"
-          - "centos-stream-9"
-          - "centos-stream-10"
-          - "fedora-latest"
-        suite:
-          - config-2
-          # - config-3
-          - config-acl
-          - config-array
-          - config-backend-search
-          - config-custom-template
-          - config-fastcgi
-          - config-resolver
-          - config-ssl-redirect
-          - "package"
-          - "source-24"
-          - "source-26"
-          - "source-28"
-          - "source-lua"
-          - "source-default"
-          # - "source-openssl"
-          # OpenSSSL libraries are not currently compiling correctly
-          # see https://github.com/sous-chefs/haproxy/issues/503
       fail-fast: false
-
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@main
-      - name: Dokken
-        uses: actionshub/test-kitchen@main
-        env:
-          CHEF_LICENSE: accept-no-persist
-          KITCHEN_LOCAL_YAML: kitchen.dokken.yml
-        with:
-          suite: ${{ matrix.suite }}
-          os: ${{ matrix.os }}
-
-  integration-amazonlinux:
-    needs: lint-unit
-    runs-on: ubuntu-24.04
-    strategy:
+      max-parallel: 4
       matrix:
         os:
-          - "amazonlinux-2023"
+          - almalinux-8
+          - almalinux-9
+          - almalinux-10
+          - amazonlinux-2023
+          - centos-stream-9
+          - centos-stream-10
+          - debian-11
+          - debian-12
+          - debian-13
+          - fedora-latest
+          - opensuse-leap-15
+          - oraclelinux-8
+          - oraclelinux-9
+          - rockylinux-8
+          - rockylinux-9
+          - rockylinux-10
+          - ubuntu-2204
+          - ubuntu-2404
         suite:
-          - "package"
-          - "source-24"
-          - "source-26"
-          - "source-28"
-          - "source-default"
-      fail-fast: false
-
+          - default
+          - package
+          - source-32
+          - source-default
+          - source-lua
+          - source-openssl
     steps:
       - name: Check out code
         uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@6.0.0
+      - name: Install Cinc Workstation
+        uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0
       - name: Dokken
-        uses: actionshub/test-kitchen@3.0.0
+        uses: actionshub/test-kitchen@main
         env:
           CHEF_LICENSE: accept-no-persist
+          CHEF_VERSION: latest
           KITCHEN_LOCAL_YAML: kitchen.dokken.yml
+          KITCHEN_PRODUCT_NAME: cinc
         with:
           suite: ${{ matrix.suite }}
           os: ${{ matrix.os }}
 
-  lua_test:
+  config-test:
     needs: lint-unit
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
+      max-parallel: 4
       matrix:
         os:
-          - "centos-stream-9"
+          - almalinux-8
+          - almalinux-9
+          - almalinux-10
+          - amazonlinux-2023
+          - centos-stream-9
+          - centos-stream-10
+          - debian-11
+          - debian-12
+          - debian-13
+          - fedora-latest
+          - opensuse-leap-15
+          - oraclelinux-8
+          - oraclelinux-9
+          - rockylinux-8
+          - rockylinux-9
+          - rockylinux-10
+          - ubuntu-2204
+          - ubuntu-2404
         suite:
-          - "source-lua"
-      fail-fast: false
-
+          - config-2
+          - config-3
+          - config-acl
+          - config-array
+          - config-backend-search
+          - config-custom-template
+          - config-fastcgi
+          - config-resolver
+          - config-ssl-redirect
     steps:
       - name: Check out code
         uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@6.0.0
+      - name: Install Cinc Workstation
+        uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0
       - name: Dokken
-        uses: actionshub/test-kitchen@3.0.0
+        uses: actionshub/test-kitchen@main
         env:
           CHEF_LICENSE: accept-no-persist
+          CHEF_VERSION: latest
           KITCHEN_LOCAL_YAML: kitchen.dokken.yml
+          KITCHEN_PRODUCT_NAME: cinc
         with:
           suite: ${{ matrix.suite }}
           os: ${{ matrix.os }}
 
-  configtest:
-    needs: lint-unit
+  final:
+    if: always()
+    needs: [integration, config-test]
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        os:
-          - "centos-stream-9"
-        suite:
-          - "config-2"
-          # - "config-3"
-          - "config-backend-search"
-          - "config-acl"
-          - "config-resolver"
-          - "config-ssl-redirect"
-          - "config-custom-template"
-          - "config-array"
-          - "config-fastcgi"
-      fail-fast: false
-
     steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@6.0.0
-      - name: Dokken
-        uses: actionshub/test-kitchen@3.0.0
+      - name: Check integration results
         env:
-          CHEF_LICENSE: accept-no-persist
-          KITCHEN_LOCAL_YAML: kitchen.dokken.yml
-        with:
-          suite: ${{ matrix.suite }}
-          os: ${{ matrix.os }}
+          CONFIG_RESULT: ${{ needs.config-test.result }}
+          INTEGRATION_RESULT: ${{ needs.integration.result }}
+        run: |
+          test "$CONFIG_RESULT" = success
+          test "$INTEGRATION_RESULT" = success
diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml
index 27c31091..e91ced69 100644
--- a/.github/workflows/conventional-commits.yml
+++ b/.github/workflows/conventional-commits.yml
@@ -9,6 +9,9 @@ name: conventional-commits
       - edited
       - synchronize
 
+permissions:
+  pull-requests: read
+
 jobs:
   conventional-commits:
     uses: sous-chefs/.github/.github/workflows/conventional-commits.yml@9.0.0
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index bd02e256..78f0971e 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v7
-      - name: Install Chef
-        uses: actionshub/chef-install@main
+      - name: Install Cinc Workstation
+        uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0
       - name: Install cookbooks
         run: chef install Policyfile.rb
diff --git a/.github/workflows/prevent-file-change.yml b/.github/workflows/prevent-file-change.yml
index 38b22df4..9254f030 100644
--- a/.github/workflows/prevent-file-change.yml
+++ b/.github/workflows/prevent-file-change.yml
@@ -12,5 +12,8 @@ name: prevent-file-change
 jobs:
   prevent-file-change:
     uses: sous-chefs/.github/.github/workflows/prevent-file-change.yml@9.0.0
+    permissions:
+      contents: read
+      pull-requests: write
     secrets:
       token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/LIMITATIONS.md b/LIMITATIONS.md
new file mode 100644
index 00000000..b1080777
--- /dev/null
+++ b/LIMITATIONS.md
@@ -0,0 +1,86 @@
+# Limitations
+
+This cookbook manages HAProxy from distribution packages or from an upstream
+source archive. It does not configure the HAProxy Technologies Enterprise
+repositories.
+
+## Upstream lifecycle
+
+HAProxy publishes both stable and long-term-support branches. The source
+installer defaults to the 3.2 LTS branch; exact patch releases are tracked in
+`resources/install.rb` and the integration test recipes.
+
+See the [HAProxy release table](https://www.haproxy.org/) for current branch
+support dates and patch releases.
+
+## Package availability
+
+The `package` installation path uses the package named `haproxy` from the
+configured operating-system repositories. The version and architecture
+therefore depend on the distribution release and enabled repositories.
+
+### APT (Debian and Ubuntu)
+
+* Debian and Ubuntu publish HAProxy in their normal archives.
+* The Debian HAProxy packaging team publishes newer supported branches through
+  [haproxy.debian.net](https://haproxy.debian.net/).
+* Vincent Bernat's Ubuntu PPAs publish branch-specific builds where available.
+  The cookbook does not add these APT repositories automatically.
+* Debian 12 and 13 and Ubuntu 22.04 and 24.04 provide HAProxy packages for
+  multiple architectures through their distribution archives.
+
+### DNF and YUM (RHEL family, Fedora, and Amazon Linux)
+
+* RHEL-family, Fedora, and Amazon Linux installations use the package available
+  from their configured distribution repositories.
+* `enable_epel_repo true` enables EPEL through the `yum-epel` cookbook before
+  package installation on RHEL-family and Amazon platforms.
+* The legacy IUS path only applies to RHEL 6 and 7. Those releases are
+  unsupported, so `enable_ius_repo` is retained only for compatibility and
+  should not be used for current deployments.
+* Package versions and architectures vary by distribution and repository; use
+  source installation when a specific HAProxy release is required.
+
+### Zypper (openSUSE Leap)
+
+* openSUSE Leap installations use the package from configured distribution
+  repositories.
+* The cookbook does not add an HAProxy-specific Zypper repository.
+
+## Architecture limitations
+
+* Source installation uses `node['kernel']['machine']` as HAProxy's `CPU` value
+  unless `source_target_cpu` is overridden.
+* Distribution package architecture coverage is controlled by each
+  distribution repository.
+* The cookbook's integration matrix primarily exercises x86_64 containers;
+  other architectures require separate validation.
+
+## Source installation
+
+HAProxy source archives are downloaded from
+`https://www.haproxy.org/download/<branch>/src/`.
+
+### Build dependencies
+
+| Platform family | Required packages |
+| --- | --- |
+| Debian | `build-essential`, OpenSSL, zlib, systemd, and PCRE development packages |
+| RHEL, Fedora, Amazon | compiler/build tools, OpenSSL, zlib, systemd, and PCRE development packages |
+| SUSE | compiler/build tools, OpenSSL, zlib, systemd, and PCRE development packages |
+
+Optional Lua and custom OpenSSL builds require the matching development headers
+and libraries. HAProxy build flags such as `USE_OPENSSL`, `USE_LUA`,
+`USE_SYSTEMD`, `USE_PCRE` or `USE_PCRE2`, and `USE_PROMEX` are exposed through
+resource properties.
+
+## Known constraints
+
+* PCRE1 packages are unavailable on newer platform releases. The cookbook
+  selects PCRE2 for Debian 13 and RHEL-family version 10 or newer.
+* The default source checksum is coupled to the default source version; custom
+  versions must supply their matching checksum.
+* Source installation compiles in Chef's file cache and installs under
+  `bin_prefix`. Removal must account for those installed artifacts.
+* The source installer supports systemd only; SysV and Upstart service
+  management are outside the supported migration scope.
diff --git a/Policyfile.lock.json b/Policyfile.lock.json
index 0688a098..ede36d59 100644
--- a/Policyfile.lock.json
+++ b/Policyfile.lock.json
@@ -1,5 +1,5 @@
 {
-  "revision_id": "b9d24e60ac21ab3c0ecba3453df8e0b255b2f00ae504f58b6828da5de4f5f4b4",
+  "revision_id": "ca265896fa8ba734bd897d6c2f87c7cd54aef7ac88a53abc1c3b6fdd386f308b",
   "name": "haproxy",
   "run_list": [
     "recipe[test::package]"
@@ -32,29 +32,26 @@
     "config_ssl_redirect": [
       "recipe[test::config_ssl_redirect]"
     ],
+    "default": [
+      "recipe[test::default]"
+    ],
     "package": [
       "recipe[test::package]"
     ],
     "source": [
       "recipe[test::source]"
     ],
-    "source_24": [
-      "recipe[test::source_24]"
-    ],
-    "source_26": [
-      "recipe[test::source_26]"
-    ],
-    "source_28": [
-      "recipe[test::source_28]"
-    ],
-    "source_28_pcre2": [
-      "recipe[test::source_28_pcre2]"
+    "source_32": [
+      "recipe[test::source_32]"
     ],
     "source_lua": [
       "recipe[test::source_lua]"
     ],
     "source_openssl": [
       "recipe[test::source_openssl]"
+    ],
+    "source_pcre2": [
+      "recipe[test::source_pcre2]"
     ]
   },
   "included_policy_locks": [
@@ -62,19 +59,19 @@
   ],
   "cookbook_locks": {
     "haproxy": {
-      "version": "12.4.13",
-      "identifier": "2d7dc66eb12cece395df07e798f1d3f94e757140",
-      "dotted_decimal_identifier": "12804665166081260.64059604856183025.233067716636992",
+      "version": "12.4.14",
+      "identifier": "80ee4e28b140d6214321d738c20944d0e77c3c83",
+      "dotted_decimal_identifier": "36290816476528854.9362486855254537.75664027565187",
       "source": ".",
       "cache_key": null,
       "scm_info": {
         "scm": "git",
-        "remote": "https://github.com/sous-chefs/haproxy.git",
-        "revision": "396d9112cf5d04b38206b178f4b92f220ba943a8",
+        "remote": "git@github.com:sous-chefs/haproxy.git",
+        "revision": "1342ab71d759819ddc6838f2bc81617933062afb",
         "working_tree_clean": false,
         "published": true,
         "synchronized_remote_branches": [
-          "origin/chore/policyfile-migration"
+          "origin/modernise-cookbook"
         ]
       },
       "source_options": {
@@ -83,18 +80,18 @@
     },
     "test": {
       "version": "0.0.1",
-      "identifier": "5e2218f2c1e05c80013463ac8232f64a91929a19",
-      "dotted_decimal_identifier": "26496138358153308.36030121541141042.270800130316825",
+      "identifier": "c34acaa0a6b844179ef341da11274687c8014d49",
+      "dotted_decimal_identifier": "54969854597707844.6648692083396903.77548990057801",
       "source": "test/cookbooks/test",
       "cache_key": null,
       "scm_info": {
         "scm": "git",
-        "remote": "https://github.com/sous-chefs/haproxy.git",
-        "revision": "396d9112cf5d04b38206b178f4b92f220ba943a8",
+        "remote": "git@github.com:sous-chefs/haproxy.git",
+        "revision": "1342ab71d759819ddc6838f2bc81617933062afb",
         "working_tree_clean": false,
         "published": true,
         "synchronized_remote_branches": [
-          "origin/chore/policyfile-migration"
+          "origin/modernise-cookbook"
         ]
       },
       "source_options": {
@@ -102,14 +99,14 @@
       }
     },
     "yum-epel": {
-      "version": "5.0.10",
-      "identifier": "3ffd59317825177023566a99bf5940e29163cfd4",
-      "dotted_decimal_identifier": "18011483056645399.31564051454213977.71341846024148",
-      "cache_key": "yum-epel-0ae39de8b609c2904012f4da4cf261b6e3361f74",
+      "version": "6.0.0",
+      "identifier": "421eb240b33bad3abac0488905905d860bacb1d5",
+      "dotted_decimal_identifier": "18611099401403309.16530883662644624.102830302867925",
+      "cache_key": "yum-epel-aaf20ab51d90d53183885fc013c545fdf57d73a4",
       "origin": "https://github.com/sous-chefs/yum-epel.git",
       "source_options": {
         "git": "https://github.com/sous-chefs/yum-epel.git",
-        "revision": "0ae39de8b609c2904012f4da4cf261b6e3361f74",
+        "revision": "aaf20ab51d90d53183885fc013c545fdf57d73a4",
         "branch": "main"
       }
     }
@@ -136,7 +133,7 @@
       ]
     ],
     "dependencies": {
-      "haproxy (12.4.13)": [
+      "haproxy (12.4.14)": [
         [
           "yum-epel",
           ">= 0.0.0"
@@ -148,7 +145,7 @@
           ">= 0.0.0"
         ]
       ],
-      "yum-epel (5.0.10)": [
+      "yum-epel (6.0.0)": [
 
       ]
     }
diff --git a/README.md b/README.md
index c90b37b5..f2e57eba 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,10 @@
 [![OpenCollective](https://opencollective.com/sous-chefs/sponsors/badge.svg)](#sponsors)
 [![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](https://opensource.org/licenses/Apache-2.0)
 
-Installs and configures HAProxy.
+Installs and configures HAProxy through custom resources.
+
+Upgrading an older wrapper cookbook or attribute-driven implementation? See the
+[resource-only migration guide](migration.md).
 
 ## Maintainers
 
@@ -15,18 +18,22 @@ This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of
 ## Requirements
 
 * HAProxy `stable` or `LTS`
-* Chef 13.9+
+* Chef Infra Client 16+
 
 ### Platforms
 
 This cookbook officially supports and is tested against the following platforms:
 
-* debian: 9 & 10
-* ubuntu: 20.04 & 21.04
-* centos: 7 & 8
-* centos-stream: 8
-* fedora: latest
-* amazonlinux: 2
+* AlmaLinux 8+
+* Amazon Linux 2023+
+* CentOS Stream 9+
+* Debian 11+
+* Fedora
+* openSUSE Leap 15+
+* Oracle Linux 8+
+* Red Hat Enterprise Linux 8+
+* Rocky Linux 8+
+* Ubuntu 22.04+
 
 PRs are welcome to add support for additional platforms.
 
@@ -40,7 +47,13 @@ HAProxy has many configurable options available, this cookbook makes the most po
 
 If you wish to use a HAProxy property that is not listed the `extra_options` hash is available to take in any number of additional values.
 
-For example, the ability to disable listeners is not provided out of the box. Further examples can be found in either `test/fixtures/recipes` or `spec/test/recipes`. If you have questions on how this works or would like to add more examples so it is easier to understand, please come talk to us on the [Chef Community Slack](http://community-slack.chef.io/) on the #sous-chefs channel.
+For example, the ability to disable listeners is not provided out of the box.
+Further examples can be found in
+[`test/cookbooks/test/recipes`](test/cookbooks/test/recipes). If you have
+questions on how this works or would like to add more examples so it is easier
+to understand, please come talk to us on the
+[Chef Community Slack](https://community-slack.chef.io/) in the
+`#sous-chefs` channel.
 
 ```ruby
 haproxy_listen 'disabled' do
diff --git a/documentation/haproxy_install.md b/documentation/haproxy_install.md
index 150493ca..833472a6 100644
--- a/documentation/haproxy_install.md
+++ b/documentation/haproxy_install.md
@@ -2,14 +2,14 @@
 
 [Back To Resource List](https://github.com/sous-chefs/haproxy#resources)
 
-Install HAProxy from package or source.
+Install HAProxy from a package or source archive.
 
 Introduced: v4.0.0
 
 ## Actions
 
-* `:create`
-* `:delete`
+* `:install`
+* `:remove`
 
 ## Properties
 
@@ -17,49 +17,56 @@ This resource also uses the following partial resources:
 
 * [_config_file](https://github.com/sous-chefs/haproxy/tree/master/documentation/partial_config_file.md)
 
-| Name                 | Type    | Default                                                          | Description                                                                    | Allowed Values      |
-| -------------------- | ------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------- |
-| `install_type`       | String  | None                                                             | Set the installation type                                                      | `package`, `source` |
-| `bin_prefix`         | String  | `/usr`                                                           | Set the source compile prefix                                                  |                     |
-| `sensitive`          | Boolean | `true`                                                           | Ensure that sensitive resource data is not logged by the chef-client           |                     |
-| `use_systemd`        | Boolean | `true`                                                           | Evalues whether to use systemd based on the nodes init package                 |                     |
-| `user`               | String  | `haproxy`                                                        | Similar to "uid" but uses the UID of user name `<user name>` from /etc/passwd  |                     |
-| `group`              | String  | `haproxy`                                                        | Similar to "gid" but uses the GID of group name `<group name>` from /etc/group |                     |
-| `package_name`       | String  | `haproxy`                                                        |                                                                                |                     |
-| `package_version`    | String  |                                                                  |                                                                                |                     |
-| `enable_ius_repo`    | Boolean | `false`                                                          | Enables the IUS package repo for Centos to install versions >1.5               |                     |
-| `enable_epel_repo`   | Boolean | `true`                                                           | Enables the epel repo for RHEL based operating systems                         |                     |
-| `source_version`     | String  | `2.2.4`                                                          |                                                                                |                     |
-| `source_url`         | String  | `http://www.haproxy.org/download/2.2.4/src/haproxy-2.2.4.tar.gz` |                                                                                |                     |
-| `source_checksum`    | String  |                                                                  |                                                                                |                     |
-| `source_target_cpu`  | String  | `node['kernel']['machine']`                                      |                                                                                |                     |
-| `source_target_arch` | String  |                                                                  |                                                                                |                     |
-| `source_target_os`   | String  | See resource                                                     |                                                                                |                     |
-| `use_libcrypt`       | Boolean | `true`                                                           |                                                                                | `true`, `false`     |
-| `use_pcre`           | Boolean | `true`                                                           | Enable PCRE regex support. Uses PCRE2 on RHEL-family >= 10 and PCRE elsewhere. | `true`, `false`     |
-| `use_openssl`        | Boolean | `true`                                                           | Include openssl support (<https://openssl.org>)                                | `true`, `false`     |
-| `use_zlib`           | Boolean | `true`                                                           | Include ZLIB support                                                           | `true`, `false`     |
-| `use_linux_tproxy`   | Boolean | `true`                                                           |                                                                                | `true`, `false`     |
-| `use_linux_splice`   | Boolean | `true`                                                           |                                                                                | `true`, `false`     |
-| `use_promex`         | Boolean | `false`                                                          | Enable the included Prometheus exporter (HAProxy v2.4+)                        | `true`, `false`     |
-| `use_systemd`        | Boolean | `true`                                                           |                                                                                | `true`, `false`     |
-| `use_lua`            | Boolean | `false`                                                          | Include Lua support                                                            | `true`, `false`     |
-| `lua_lib`            | String  |                                                                  | Path for lua library files ex: `/opt/lib-5.3.5/lib`                            |                     |
-| `lua_inc`            | String  |                                                                  | Path for lua library files ex: `/opt/lib-5.3.5/include`                        |                     |
-| `ssl_lib`            | String  |                                                                  | Path for openssl library files ex: `/usr/local/openssl/lib`                    |                     |
-| `ssl_inc`            | String  |                                                                  | Path for openssl includes files ex: `/usr/local/openssl/inc`                   |                     |
+<!-- markdownlint-disable MD060 -->
+
+| Name                 | Type    | Default                             | Description                                                                    | Allowed Values      |
+| -------------------- | ------- | ----------------------------------- | ------------------------------------------------------------------------------ | ------------------- |
+| `install_type`       | String  | Resource name                       | Set the installation type                                                      | `package`, `source` |
+| `bin_prefix`         | String  | `/usr`                              | Set the source compile prefix                                                  |                     |
+| `sensitive`          | Boolean | `true`                              | Ensure that sensitive resource data is not logged by Chef Infra Client         |                     |
+| `user`               | String  | `haproxy`                           | User that owns HAProxy-managed files                                            |                     |
+| `group`              | String  | `haproxy`                           | Group that owns HAProxy-managed files                                           |                     |
+| `package_name`       | String  | `haproxy`                           | Package to install or remove                                                    |                     |
+| `package_version`    | String  | None                                | Optional package version                                                        |                     |
+| `enable_ius_repo`    | Boolean | `false`                             | Enable the IUS repository on supported RHEL-family systems                      |                     |
+| `enable_epel_repo`   | Boolean | `true`                              | Enable the EPEL repository on RHEL-family and Amazon systems                    |                     |
+| `source_version`     | String  | `3.2.14`                            | HAProxy version to compile                                                      |                     |
+| `source_url`         | String  | Derived from `source_version`       | HTTPS URL for the HAProxy source archive                                        |                     |
+| `source_checksum`    | String  | Checksum for the default archive    | SHA-256 checksum used to verify the source archive                              |                     |
+| `source_target_cpu`  | String  | Node kernel machine                 | CPU target passed to `make`                                                     |                     |
+| `source_target_arch` | String  | None                                | Optional architecture passed to `make`                                          |                     |
+| `source_target_os`   | String  | Derived from platform and version   | HAProxy build target passed to `make`                                            |                     |
+| `use_libcrypt`       | Boolean | `true`                              | Include libcrypt support                                                        | `true`, `false`     |
+| `use_pcre`           | Boolean | `true`                              | Enable PCRE support, selecting PCRE or PCRE2 for the platform                   | `true`, `false`     |
+| `use_openssl`        | Boolean | `true`                              | Include OpenSSL support                                                         | `true`, `false`     |
+| `use_zlib`           | Boolean | `true`                              | Include zlib support                                                            | `true`, `false`     |
+| `use_linux_tproxy`   | Boolean | `true`                              | Include Linux transparent proxy support                                         | `true`, `false`     |
+| `use_linux_splice`   | Boolean | `true`                              | Include Linux splice support                                                    | `true`, `false`     |
+| `use_promex`         | Boolean | `false`                             | Enable the built-in Prometheus exporter                                         | `true`, `false`     |
+| `use_systemd`        | Boolean | HAProxy 1.8 and newer               | Include systemd support when compiling from source                              | `true`, `false`     |
+| `use_lua`            | Boolean | `false`                             | Include Lua support                                                             | `true`, `false`     |
+| `lua_lib`            | String  | None                                | Path to Lua library files                                                       |                     |
+| `lua_inc`            | String  | None                                | Path to Lua include files                                                       |                     |
+| `ssl_lib`            | String  | None                                | Path to OpenSSL library files                                                   |                     |
+| `ssl_inc`            | String  | None                                | Path to OpenSSL include files                                                   |                     |
+
+<!-- markdownlint-enable MD060 -->
 
 ## Examples
 
+Install the platform package:
+
 ```ruby
 haproxy_install 'package'
 ```
 
+Compile a pinned source release:
+
 ```ruby
 haproxy_install 'source' do
-  source_url node['haproxy']['source_url']
-  source_checksum node['haproxy']['source_checksum']
-  source_version node['haproxy']['source_version']
+  source_version '3.2.14'
+  source_url 'https://www.haproxy.org/download/3.2/src/haproxy-3.2.14.tar.gz'
+  source_checksum 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4'
   use_pcre true
   use_openssl true
   use_zlib true
@@ -67,3 +74,11 @@ haproxy_install 'source' do
   use_linux_splice true
 end
 ```
+
+Remove a package installation:
+
+```ruby
+haproxy_install 'package' do
+  action :remove
+end
+```
diff --git a/documentation/haproxy_service.md b/documentation/haproxy_service.md
index 9e4693d6..3c1b1aed 100644
--- a/documentation/haproxy_service.md
+++ b/documentation/haproxy_service.md
@@ -2,8 +2,8 @@
 
 [Back To Resource List](https://github.com/sous-chefs/haproxy#resources)
 
-Configures HAProxy as a systemd service.
-To reload HAProxy service add a subscribes option to the resource block. See example below. To reload the HAProxy service add a subscribes option to the resource block. See example below.
+Configures HAProxy as a systemd service. To reload HAProxy after its
+configuration changes, add a subscription to the resource block.
 
 Introduced: v4.0.0
 
@@ -16,6 +16,7 @@ Introduced: v4.0.0
 * `:restart`
 * `:reload`
 * `:enable`
+* `:disable`
 
 ## Properties
 
diff --git a/files/haproxy-default b/files/haproxy-default
deleted file mode 100644
index e69de29b..00000000
diff --git a/kitchen.dokken.yml b/kitchen.dokken.yml
index c4f69844..27283017 100644
--- a/kitchen.dokken.yml
+++ b/kitchen.dokken.yml
@@ -1,11 +1,15 @@
+---
 driver:
   name: dokken
   privileged: true
-  chef_version: <%= ENV['CHEF_VERSION'] || 'current' %>
+  chef_image: "<%= ENV.fetch('KITCHEN_PRODUCT_NAME', 'cinc') == 'cinc' ? 'cincproject/cinc' : 'chef/chef' %>"
+  chef_version: "<%= ENV['CHEF_VERSION'] || (ENV.fetch('KITCHEN_PRODUCT_NAME', 'cinc') == 'cinc' ? 'latest' : 'current') %>"
 
 transport: { name: dokken }
 provisioner:
   name: dokken
+  chef_binary: "<%= ENV.fetch('KITCHEN_PRODUCT_NAME', 'cinc') == 'cinc' ? '/opt/cinc/bin/cinc-client' : '/opt/chef/bin/chef-client' %>"
+  product_name: "<%= ENV['KITCHEN_PRODUCT_NAME'] || 'cinc' %>"
   policyfile: Policyfile.rb
 
 platforms:
@@ -49,6 +53,11 @@ platforms:
       image: dokken/debian-12
       pid_one_command: /bin/systemd
 
+  - name: debian-13
+    driver:
+      image: dokken/debian-13
+      pid_one_command: /usr/lib/systemd/systemd
+
   - name: fedora-latest
     driver:
       image: dokken/fedora-latest
@@ -79,10 +88,10 @@ platforms:
       image: dokken/rockylinux-9
       pid_one_command: /usr/lib/systemd/systemd
 
-  - name: ubuntu-20.04
+  - name: rockylinux-10
     driver:
-      image: dokken/ubuntu-20.04
-      pid_one_command: /bin/systemd
+      image: dokken/rockylinux-10
+      pid_one_command: /usr/lib/systemd/systemd
 
   - name: ubuntu-22.04
     driver:
diff --git a/kitchen.exec.yml b/kitchen.exec.yml
deleted file mode 100644
index ba7b2a96..00000000
--- a/kitchen.exec.yml
+++ /dev/null
@@ -1,7 +0,0 @@
----
-driver: { name: exec }
-transport: { name: exec }
-
-platforms:
-  - name: macos-latest
-  - name: windows-latest
diff --git a/kitchen.global.yml b/kitchen.global.yml
index 184759bf..7f31f648 100644
--- a/kitchen.global.yml
+++ b/kitchen.global.yml
@@ -1,15 +1,11 @@
 ---
 provisioner:
   name: policyfile_zero
-  product_name: chef
-  product_version: <%= ENV['CHEF_VERSION'] || 'latest' %>
-  channel: stable
-  install_strategy: once
+  product_name: cinc
   chef_license: accept
-  enforce_idempotency: <%= ENV['ENFORCE_IDEMPOTENCY'] || true %>
-  multiple_converge: <%= ENV['MULTIPLE_CONVERGE'] || 2 %>
+  enforce_idempotency: true
+  multiple_converge: 2
   deprecations_as_errors: true
-  log_level: <%= ENV['CHEF_LOG_LEVEL'] || 'auto' %>
   policyfile: Policyfile.rb
 
 verifier:
@@ -18,16 +14,19 @@ verifier:
 platforms:
   - name: almalinux-8
   - name: almalinux-9
+  - name: almalinux-10
   - name: amazonlinux-2023
   - name: centos-stream-9
+  - name: centos-stream-10
   - name: debian-11
   - name: debian-12
+  - name: debian-13
   - name: fedora-latest
   - name: opensuse-leap-15
   - name: oraclelinux-8
   - name: oraclelinux-9
   - name: rockylinux-8
   - name: rockylinux-9
-  - name: ubuntu-20.04
+  - name: rockylinux-10
   - name: ubuntu-22.04
   - name: ubuntu-24.04
diff --git a/kitchen.yml b/kitchen.yml
index 6017dd86..0a55f8e6 100644
--- a/kitchen.yml
+++ b/kitchen.yml
@@ -4,41 +4,47 @@ driver:
 
 provisioner:
   name: policyfile_zero
+  product_name: cinc
+  enforce_idempotency: true
+  multiple_converge: 2
   deprecations_as_errors: true
   chef_license: accept
-  product_name: chef
-  product_version: <%= ENV['CHEF_VERSION'] || 'latest' %>
-  install_strategy: always
-  log_level: <%= ENV['CHEF_LOG_LEVEL'] || 'auto' %>
   policyfile: Policyfile.rb
 
 verifier:
   name: inspec
 
 platforms:
+  - name: almalinux-8
+  - name: almalinux-9
+  - name: almalinux-10
   - name: amazonlinux-2023
-  - name: centos-stream-8
   - name: centos-stream-9
+  - name: centos-stream-10
   - name: debian-11
   - name: debian-12
-  - name: ubuntu-20.04
-  - name: ubuntu-22.04
+  - name: debian-13
   - name: fedora-latest
+  - name: opensuse-leap-15
+  - name: oraclelinux-8
+  - name: oraclelinux-9
+  - name: rockylinux-8
+  - name: rockylinux-9
+  - name: rockylinux-10
+  - name: ubuntu-22.04
+  - name: ubuntu-24.04
 
 suites:
+  - name: default
+    provisioner:
+      named_run_list: default
   - name: package
     provisioner:
       named_run_list: package
-  - name: source-2.4
+  - name: source_3.2
     provisioner:
-      named_run_list: source_24
-  - name: source_2.6
-    provisioner:
-      named_run_list: source_26
-  - name: source_2.8
-    provisioner:
-      named_run_list: source_28
-  - name: source_default
+      named_run_list: source_32
+  - name: source-default
     provisioner:
       named_run_list: source
   - name: source_lua
@@ -53,9 +59,6 @@ suites:
   - name: config_3
     provisioner:
       named_run_list: config_3
-  - name: config_4
-    provisioner:
-      named_run_list: config_4
   - name: config_backend_search
     provisioner:
       named_run_list: config_backend_search
diff --git a/libraries/helpers.rb b/libraries/helpers.rb
index 570960d3..c21008c0 100644
--- a/libraries/helpers.rb
+++ b/libraries/helpers.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Haproxy
   module Cookbook
     module Helpers
@@ -16,10 +18,16 @@ def pcre_package_name
         end
       end
 
+      def debian_pcre_package_name
+        # Debian 13+ (trixie) dropped libpcre3-dev, use libpcre2-dev
+        # Ubuntu still ships libpcre3-dev, so only check actual Debian
+        platform?('debian') && platform_version.to_i >= 13 ? 'libpcre2-dev' : 'libpcre3-dev'
+      end
+
       def source_package_list
         case node['platform_family']
         when 'debian'
-          %w(libpcre3-dev libssl-dev zlib1g-dev libsystemd-dev)
+          [debian_pcre_package_name, 'libssl-dev', 'zlib1g-dev', 'libsystemd-dev']
         when 'rhel', 'amazon', 'fedora'
           [pcre_package_name, 'openssl-devel', 'zlib-devel', 'systemd-devel', 'tar']
         when 'suse'
diff --git a/libraries/resource.rb b/libraries/resource.rb
index 9d5f7c90..8f03ef84 100644
--- a/libraries/resource.rb
+++ b/libraries/resource.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Haproxy
   module Cookbook
     module ResourceHelpers
diff --git a/libraries/template.rb b/libraries/template.rb
index 7b6d151e..ad3b21b7 100644
--- a/libraries/template.rb
+++ b/libraries/template.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Haproxy
   module Cookbook
     module TemplateHelpers
diff --git a/metadata.rb b/metadata.rb
index 92adffe5..2eeaf37a 100644
--- a/metadata.rb
+++ b/metadata.rb
@@ -1,16 +1,23 @@
+# frozen_string_literal: true
+
 name              'haproxy'
 maintainer        'Sous Chefs'
 maintainer_email  'help@sous-chefs.org'
 license           'Apache-2.0'
-description       'Installs and configures haproxy'
+description       'Provides resources to install and configure HAProxy'
 version           '12.4.14'
 source_url        'https://github.com/sous-chefs/haproxy'
 issues_url        'https://github.com/sous-chefs/haproxy/issues'
 chef_version      '>= 16'
 
-supports 'debian'
-supports 'ubuntu'
-supports 'centos'
-supports 'amazon'
-supports 'opensuseleap'
+supports 'almalinux', '>= 8.0'
+supports 'amazon', '>= 2023.0'
+supports 'centos_stream', '>= 9.0'
+supports 'debian', '>= 11.0'
+supports 'fedora'
+supports 'opensuseleap', '>= 15.0'
+supports 'oracle', '>= 8.0'
+supports 'redhat', '>= 8.0'
+supports 'rocky', '>= 8.0'
+supports 'ubuntu', '>= 22.04'
 depends 'yum-epel'
diff --git a/migration.md b/migration.md
new file mode 100644
index 00000000..fb75f70d
--- /dev/null
+++ b/migration.md
@@ -0,0 +1,84 @@
+# Migrating to the Resource-Only API
+
+The haproxy cookbook exposes custom resources as its production API. Wrapper
+cookbooks should declare those resources directly instead of including a
+production recipe or configuring HAProxy through node attributes.
+
+## Replace Recipe and Attribute Usage
+
+Replace attribute-driven recipe usage such as:
+
+```ruby
+node.default['haproxy']['install_method'] = 'package'
+include_recipe 'haproxy'
+```
+
+with explicit resource declarations:
+
+```ruby
+haproxy_install 'package'
+
+haproxy_config_global 'global'
+
+haproxy_config_defaults 'defaults' do
+  mode 'http'
+  timeout(
+    'connect' => '5s',
+    'client' => '50s',
+    'server' => '50s'
+  )
+end
+
+haproxy_service 'haproxy' do
+  action %i(create enable start)
+end
+```
+
+Declare frontends, backends, listeners, ACLs, resolvers, and other configuration
+sections with the corresponding resources listed in the
+[README](README.md#resources). Properties on those resources replace cookbook
+attributes and make each wrapper cookbook's HAProxy contract explicit.
+
+## Package and Source Installation
+
+Package installation uses the platform package manager:
+
+```ruby
+haproxy_install 'package'
+```
+
+Source installation requires a version, URL, and matching SHA-256 checksum when
+overriding the cookbook defaults:
+
+```ruby
+haproxy_install 'source' do
+  source_version '3.2.14'
+  source_url 'https://www.haproxy.org/download/3.2/src/haproxy-3.2.14.tar.gz'
+  source_checksum 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4'
+end
+```
+
+## Removal
+
+Use the resources' removal actions to reverse managed state:
+
+```ruby
+haproxy_service 'haproxy' do
+  action :delete
+end
+
+haproxy_install 'package' do
+  action :remove
+end
+```
+
+The service delete action stops and disables the unit before removing it. The
+source install remove action deletes the compiled HAProxy binary, legacy
+wrapper when applicable, man page, downloaded archive, and extracted source
+directory.
+
+## Platform Constraints
+
+Review [LIMITATIONS.md](LIMITATIONS.md) before changing HAProxy release tracks
+or relying on distribution packages. The test cookbook under
+`test/cookbooks/test` is development-only and is not a production entrypoint.
diff --git a/mise.toml b/mise.toml
index 43fe9b0a..c8751336 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,2 +1,3 @@
 [env]
 _.path = "/opt/chef-workstation/bin"
+KITCHEN_LOCAL_YAML = "kitchen.dokken.yml"
diff --git a/renovate.json b/renovate.json
index d5116fd6..f938ff19 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,6 +3,17 @@
   "extends": [
     "config:recommended"
   ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^.+$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>[a-zA-Z0-9-._]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s+version\\s*=\\s*[\"']?(?<currentValue>[^\"'\\s]+)[\"']?"
+      ]
+    }
+  ],
   "packageRules": [
     {
       "groupName": "Actions",
diff --git a/resources/partial/_config_file.rb b/resources/_partial/_config_file.rb
similarity index 97%
rename from resources/partial/_config_file.rb
rename to resources/_partial/_config_file.rb
index 4a09b51a..1a1c9460 100644
--- a/resources/partial/_config_file.rb
+++ b/resources/_partial/_config_file.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 property :user, String,
           default: 'haproxy',
           description: 'Set to override default haproxy user, defaults to haproxy'
diff --git a/resources/partial/_extra_options.rb b/resources/_partial/_extra_options.rb
similarity index 75%
rename from resources/partial/_extra_options.rb
rename to resources/_partial/_extra_options.rb
index abccb58f..2b9eb416 100644
--- a/resources/partial/_extra_options.rb
+++ b/resources/_partial/_extra_options.rb
@@ -1,2 +1,4 @@
+# frozen_string_literal: true
+
 property :extra_options, Hash,
           description: 'Used for setting any HAProxy directives'
diff --git a/resources/acl.rb b/resources/acl.rb
index 1a88bcde..d2a81046 100644
--- a/resources/acl.rb
+++ b/resources/acl.rb
@@ -1,4 +1,8 @@
-use 'partial/_config_file'
+# frozen_string_literal: true
+
+provides :haproxy_acl
+
+use '_partial/_config_file'
 
 property :acl, [String, Array],
           name_property: true,
diff --git a/resources/backend.rb b/resources/backend.rb
index 1da26dca..bcf6ec83 100644
--- a/resources/backend.rb
+++ b/resources/backend.rb
@@ -1,5 +1,9 @@
-use 'partial/_config_file'
-use 'partial/_extra_options'
+# frozen_string_literal: true
+
+provides :haproxy_backend
+
+use '_partial/_config_file'
+use '_partial/_extra_options'
 
 property :mode, String,
           equal_to: %w(http tcp health),
diff --git a/resources/cache.rb b/resources/cache.rb
index 8e7b7d23..5b605389 100644
--- a/resources/cache.rb
+++ b/resources/cache.rb
@@ -1,4 +1,8 @@
-use 'partial/_config_file'
+# frozen_string_literal: true
+
+provides :haproxy_cache
+
+use '_partial/_config_file'
 
 property :cache_name, String,
           name_property: true,
diff --git a/resources/config_defaults.rb b/resources/config_defaults.rb
index 501880b9..4129d7ca 100644
--- a/resources/config_defaults.rb
+++ b/resources/config_defaults.rb
@@ -1,5 +1,9 @@
-use 'partial/_config_file'
-use 'partial/_extra_options'
+# frozen_string_literal: true
+
+provides :haproxy_config_defaults
+
+use '_partial/_config_file'
+use '_partial/_extra_options'
 
 property :timeout, Hash,
           default: { client: '10s', server: '10s', connect: '10s' },
@@ -62,3 +66,8 @@
   haproxy_config_resource.variables['defaults']['hash_type'] = new_resource.hash_type if property_is_set?(:hash_type)
   haproxy_config_resource.variables['defaults']['extra_options'] = new_resource.extra_options if property_is_set?(:extra_options)
 end
+
+action :delete do
+  haproxy_config_resource_init
+  haproxy_config_resource.variables.delete('defaults')
+end
diff --git a/resources/config_global.rb b/resources/config_global.rb
index e74f319c..b085100a 100644
--- a/resources/config_global.rb
+++ b/resources/config_global.rb
@@ -1,5 +1,9 @@
-use 'partial/_config_file'
-use 'partial/_extra_options'
+# frozen_string_literal: true
+
+provides :haproxy_config_global
+
+use '_partial/_config_file'
+use '_partial/_extra_options'
 
 property :pidfile, String,
           default: '/var/run/haproxy.pid',
@@ -68,3 +72,8 @@
   haproxy_config_resource.variables['global']['tuning'] = new_resource.tuning if property_is_set?(:tuning)
   haproxy_config_resource.variables['global']['extra_options'] = new_resource.extra_options if property_is_set?(:extra_options)
 end
+
+action :delete do
+  haproxy_config_resource_init
+  haproxy_config_resource.variables.delete('global')
+end
diff --git a/resources/fastcgi.rb b/resources/fastcgi.rb
index eb7313e3..dba27cd6 100644
--- a/resources/fastcgi.rb
+++ b/resources/fastcgi.rb
@@ -1,4 +1,8 @@
-use 'partial/_config_file'
+# frozen_string_literal: true
+
+provides :haproxy_fastcgi
+
+use '_partial/_config_file'
 
 property :fastcgi, String,
           name_property: true,
diff --git a/resources/frontend.rb b/resources/frontend.rb
index 0f2d5ff3..f2e6ef2f 100644
--- a/resources/frontend.rb
+++ b/resources/frontend.rb
@@ -1,5 +1,9 @@
-use 'partial/_config_file'
-use 'partial/_extra_options'
+# frozen_string_literal: true
+
+provides :haproxy_frontend
+
+use '_partial/_config_file'
+use '_partial/_extra_options'
 
 property :bind, [String, Hash],
           default: '0.0.0.0:80',
diff --git a/resources/install.rb b/resources/install.rb
index 5b61c3c2..c6b16279 100644
--- a/resources/install.rb
+++ b/resources/install.rb
@@ -1,6 +1,10 @@
+# frozen_string_literal: true
+
+provides :haproxy_install
+
 include Haproxy::Cookbook::Helpers
 
-use 'partial/_config_file'
+use '_partial/_config_file'
 
 property :install_type, String,
           name_property: true,
@@ -31,13 +35,13 @@
 
 # Source
 property :source_version, String,
-          default: '2.8.5'
+          default: '3.2.14'
 
 property :source_url, String,
           default: lazy { "https://www.haproxy.org/download/#{source_version.to_f}/src/haproxy-#{source_version}.tar.gz" }
 
 property :source_checksum, String,
-          default: '3f5459c5a58e0b343a32eaef7ed5bed9d3fc29d8aa9e14b36c92c969fc2a60d9'
+          default: 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4'
 
 property :source_target_cpu, String,
           default: lazy { node['kernel']['machine'] }
@@ -86,10 +90,6 @@
 
 unified_mode true
 
-action_class do
-  include Haproxy::Cookbook::ResourceHelpers
-end
-
 action_class do
   include Haproxy::Cookbook::Helpers
   include Haproxy::Cookbook::ResourceHelpers
@@ -99,8 +99,12 @@ def compile_make_boolean(bool)
   end
 
   def pcre_make_flag
-    # Use PCRE2 for RHEL/CentOS/AlmaLinux/Rocky >= 10, PCRE for < 10 and other platforms
-    pcre_package_name.include?('pcre2') ? 'USE_PCRE2' : 'USE_PCRE'
+    # Use PCRE2 for RHEL >= 10 and Debian >= 13, PCRE for older and other platforms
+    if platform_family?('debian')
+      debian_pcre_package_name.include?('pcre2') ? 'USE_PCRE2' : 'USE_PCRE'
+    else
+      pcre_package_name.include?('pcre2') ? 'USE_PCRE2' : 'USE_PCRE'
+    end
   end
 end
 
@@ -190,3 +194,34 @@ def pcre_make_flag
     end
   end
 end
+
+action :remove do
+  case new_resource.install_type
+  when 'package'
+    package new_resource.package_name do
+      action :remove
+    end
+  when 'source'
+    file ::File.join(new_resource.bin_prefix, 'sbin', 'haproxy') do
+      action :delete
+    end
+
+    file ::File.join(new_resource.bin_prefix, 'sbin', 'haproxy-systemd-wrapper') do
+      action :delete
+      only_if { new_resource.source_version.to_f < 1.8 }
+    end
+
+    file ::File.join(new_resource.bin_prefix, 'share', 'man', 'man1', 'haproxy.1') do
+      action :delete
+    end
+
+    file ::File.join(Chef::Config[:file_cache_path], "haproxy-#{new_resource.source_version}.tar.gz") do
+      action :delete
+    end
+
+    directory ::File.join(Chef::Config[:file_cache_path], "haproxy-#{new_resource.source_version}") do
+      recursive true
+      action :delete
+    end
+  end
+end
diff --git a/resources/listen.rb b/resources/listen.rb
index 6eb30d41..3deb7c1c 100644
--- a/resources/listen.rb
+++ b/resources/listen.rb
@@ -1,5 +1,9 @@
-use 'partial/_config_file'
-use 'partial/_extra_options'
+# frozen_string_literal: true
+
+provides :haproxy_listen
+
+use '_partial/_config_file'
+use '_partial/_extra_options'
 
 property :bind, [String, Hash],
           default: '0.0.0.0:80',
diff --git a/resources/mailer.rb b/resources/mailer.rb
index 0d4b3c7b..9e191247 100644
--- a/resources/mailer.rb
+++ b/resources/mailer.rb
@@ -1,4 +1,8 @@
-use 'partial/_config_file'
+# frozen_string_literal: true
+
+provides :haproxy_mailer
+
+use '_partial/_config_file'
 
 property :mailer, [String, Array],
           coerce: proc { |p| Array(p).flatten },
diff --git a/resources/peer.rb b/resources/peer.rb
index c0c27c6b..da940e96 100644
--- a/resources/peer.rb
+++ b/resources/peer.rb
@@ -1,5 +1,9 @@
-use 'partial/_config_file'
-use 'partial/_extra_options'
+# frozen_string_literal: true
+
+provides :haproxy_peer
+
+use '_partial/_config_file'
+use '_partial/_extra_options'
 
 property :bind, [String, Hash],
           description: 'String - sets as given. Hash - joins with a space. HAProxy version >= 2.0'
diff --git a/resources/resolver.rb b/resources/resolver.rb
index 7eee0458..3ecf1737 100644
--- a/resources/resolver.rb
+++ b/resources/resolver.rb
@@ -1,5 +1,9 @@
-use 'partial/_config_file'
-use 'partial/_extra_options'
+# frozen_string_literal: true
+
+provides :haproxy_resolver
+
+use '_partial/_config_file'
+use '_partial/_extra_options'
 
 property :nameserver, Array,
           description: 'DNS server description'
diff --git a/resources/service.rb b/resources/service.rb
index 014198c2..3a4ca492 100644
--- a/resources/service.rb
+++ b/resources/service.rb
@@ -1,6 +1,10 @@
+# frozen_string_literal: true
+
+provides :haproxy_service
+
 include Haproxy::Cookbook::Helpers
 
-use 'partial/_config_file'
+use '_partial/_config_file'
 
 property :bin_prefix, String,
           default: '/usr',
@@ -44,7 +48,7 @@ def do_service_action(resource_action)
             Chef::Log.info("Configuration test disabled, creating #{new_resource.service_name} #{new_resource.declared_type} resource with action #{resource_action}")
           end
 
-          declare_resource(:service, new_resource.service_name).delayed_action(resource_action)
+          declare_resource(:systemd_unit, "#{new_resource.service_name}.service").delayed_action(resource_action)
         rescue Mixlib::ShellOut::ShellCommandFailed
           if new_resource.config_test_fail_action.eql?(:log)
             Chef::Log.error("Configuration test failed, #{new_resource.service_name} #{resource_action} action aborted!\n\n" \
@@ -55,7 +59,7 @@ def do_service_action(resource_action)
           end
         end
       else
-        declare_resource(:service, new_resource.service_name).delayed_action(resource_action)
+        declare_resource(:systemd_unit, "#{new_resource.service_name}.service").delayed_action(resource_action)
       end
     end
   end
@@ -63,9 +67,8 @@ def do_service_action(resource_action)
 
 action :create do
   with_run_context :root do
-    declare_resource(:cookbook_file, '/etc/default/haproxy') do
-      cookbook 'haproxy'
-      source 'haproxy-default'
+    declare_resource(:file, '/etc/default/haproxy') do
+      content ''
       owner 'root'
       group 'root'
       mode '0644'
@@ -81,8 +84,8 @@ def do_service_action(resource_action)
 
 action :delete do
   with_run_context :root do
-    declare_resource(:cookbook_file, '/etc/default/haproxy').action(:delete)
-    declare_resource(:systemd_unit, "#{new_resource.service_name}.service").action(:delete)
+    declare_resource(:file, '/etc/default/haproxy').action(:delete)
+    declare_resource(:systemd_unit, "#{new_resource.service_name}.service").action(%i(stop disable delete))
   end
 end
 
diff --git a/resources/use_backend.rb b/resources/use_backend.rb
index 0464043e..3fbb5718 100644
--- a/resources/use_backend.rb
+++ b/resources/use_backend.rb
@@ -1,4 +1,8 @@
-use 'partial/_config_file'
+# frozen_string_literal: true
+
+provides :haproxy_use_backend
+
+use '_partial/_config_file'
 
 property :use_backend, [String, Array],
           name_property: true,
diff --git a/resources/userlist.rb b/resources/userlist.rb
index 5e9b2bdb..6f897831 100644
--- a/resources/userlist.rb
+++ b/resources/userlist.rb
@@ -1,4 +1,8 @@
-use 'partial/_config_file'
+# frozen_string_literal: true
+
+provides :haproxy_userlist
+
+use '_partial/_config_file'
 
 property :group, Hash,
           description: 'Adds group <groupname> to the current userlist'
diff --git a/spec/helpers_spec.rb b/spec/helpers_spec.rb
new file mode 100644
index 00000000..b8d11e4c
--- /dev/null
+++ b/spec/helpers_spec.rb
@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_relative '../libraries/helpers'
+
+describe Haproxy::Cookbook::Helpers do
+  let(:helper_class) do
+    Class.new do
+      include Haproxy::Cookbook::Helpers
+
+      attr_accessor :node
+
+      def platform_family?(family)
+        node['platform_family'] == family
+      end
+
+      def platform?(platform)
+        node['platform'] == platform
+      end
+
+      def platform_version
+        node['platform_version']
+      end
+    end
+  end
+
+  let(:helper) { helper_class.new }
+
+  describe '#source_package_list' do
+    it 'uses PCRE2 development headers on Debian 13' do
+      helper.node = {
+        'platform' => 'debian',
+        'platform_family' => 'debian',
+        'platform_version' => '13',
+      }
+
+      expect(helper.source_package_list).to include('libpcre2-dev')
+      expect(helper.source_package_list).not_to include('libpcre3-dev')
+    end
+
+    it 'uses PCRE2 development headers on RHEL-family version 10' do
+      helper.node = {
+        'platform' => 'almalinux',
+        'platform_family' => 'rhel',
+        'platform_version' => '10',
+      }
+
+      expect(helper.source_package_list).to include('pcre2-devel')
+      expect(helper.source_package_list).not_to include('pcre-devel')
+    end
+  end
+
+  describe '#target_os' do
+    it 'selects the current Linux glibc target' do
+      helper.node = {
+        'kernel' => {
+          'release' => '6.8.0-71-generic',
+        },
+      }
+
+      expect(helper.target_os('3.2.14')).to eq('linux-glibc')
+    end
+  end
+end
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 387442c3..8fcdead0 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'chefspec'
 require 'chefspec/policyfile'
 
diff --git a/spec/unit/recipes/cache_spec.rb b/spec/unit/resources/cache_spec.rb
similarity index 97%
rename from spec/unit/recipes/cache_spec.rb
rename to spec/unit/resources/cache_spec.rb
index 53da0f76..96da7253 100644
--- a/spec/unit/recipes/cache_spec.rb
+++ b/spec/unit/resources/cache_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_cache' do
diff --git a/spec/unit/resources/components_spec.rb b/spec/unit/resources/components_spec.rb
new file mode 100644
index 00000000..cb337d81
--- /dev/null
+++ b/spec/unit/resources/components_spec.rb
@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'HAProxy configuration component resources' do
+  step_into :haproxy_acl,
+            :haproxy_frontend,
+            :haproxy_resolver,
+            :haproxy_use_backend,
+            :haproxy_userlist
+
+  platform 'ubuntu', '24.04'
+
+  recipe do
+    haproxy_frontend 'http' do
+      bind '0.0.0.0:80'
+    end
+
+    haproxy_acl 'api_path path_beg /api' do
+      section 'frontend'
+      section_name 'http'
+    end
+
+    haproxy_use_backend 'api if api_path' do
+      section 'frontend'
+      section_name 'http'
+    end
+
+    haproxy_resolver 'dns' do
+      nameserver ['google 8.8.8.8:53']
+    end
+
+    haproxy_userlist 'operators' do
+      group('admins' => 'users alice')
+      user('alice' => 'insecure-password change-me')
+    end
+  end
+
+  it do
+    is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(
+      %r{acl api_path path_beg /api.*use_backend api if api_path}m
+    )
+  end
+
+  it do
+    is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(
+      /resolvers dns.*nameserver google 8\.8\.8\.8:53/m
+    )
+  end
+
+  it do
+    is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(
+      /userlist operators.*group admins users alice.*user alice insecure-password change-me/m
+    )
+  end
+end
diff --git a/spec/unit/recipes/defaults_spec.rb b/spec/unit/resources/defaults_spec.rb
similarity index 68%
rename from spec/unit/recipes/defaults_spec.rb
rename to spec/unit/resources/defaults_spec.rb
index 005e6590..ad1c2ac2 100644
--- a/spec/unit/recipes/defaults_spec.rb
+++ b/spec/unit/resources/defaults_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_config_defaults' do
@@ -25,4 +27,14 @@
 
     it { is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(cfg_content) }
   end
+
+  context 'delete haproxy config defaults' do
+    recipe do
+      haproxy_config_defaults 'default' do
+        action :delete
+      end
+    end
+
+    it { is_expected.not_to render_file('/etc/haproxy/haproxy.cfg').with_content(/^defaults$/) }
+  end
 end
diff --git a/spec/unit/recipes/fastcgi_spec.rb b/spec/unit/resources/fastcgi_spec.rb
similarity index 98%
rename from spec/unit/recipes/fastcgi_spec.rb
rename to spec/unit/resources/fastcgi_spec.rb
index 2cef46b2..c61b8ec4 100644
--- a/spec/unit/recipes/fastcgi_spec.rb
+++ b/spec/unit/resources/fastcgi_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_fastcgi' do
diff --git a/spec/unit/recipes/frontend_backend_spec.rb b/spec/unit/resources/frontend_backend_spec.rb
similarity index 97%
rename from spec/unit/recipes/frontend_backend_spec.rb
rename to spec/unit/resources/frontend_backend_spec.rb
index 46199ac8..26b08970 100644
--- a/spec/unit/recipes/frontend_backend_spec.rb
+++ b/spec/unit/resources/frontend_backend_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_frontend' do
diff --git a/spec/unit/recipes/global_spec.rb b/spec/unit/resources/global_spec.rb
similarity index 67%
rename from spec/unit/recipes/global_spec.rb
rename to spec/unit/resources/global_spec.rb
index fd4cc041..4ddf1e2c 100644
--- a/spec/unit/recipes/global_spec.rb
+++ b/spec/unit/resources/global_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_config_global' do
@@ -25,4 +27,14 @@
 
     it { is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(cfg_content) }
   end
+
+  context 'delete haproxy config global' do
+    recipe do
+      haproxy_config_global 'global' do
+        action :delete
+      end
+    end
+
+    it { is_expected.not_to render_file('/etc/haproxy/haproxy.cfg').with_content(/^global$/) }
+  end
 end
diff --git a/spec/unit/recipes/install_spec.rb b/spec/unit/resources/install_spec.rb
similarity index 66%
rename from spec/unit/recipes/install_spec.rb
rename to spec/unit/resources/install_spec.rb
index 8fd354ba..3baab034 100644
--- a/spec/unit/recipes/install_spec.rb
+++ b/spec/unit/resources/install_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_install' do
@@ -12,6 +14,38 @@
     it { is_expected.to install_package('haproxy') }
   end
 
+  context 'remove haproxy installed using the package method' do
+    recipe do
+      haproxy_install 'package' do
+        action :remove
+      end
+    end
+
+    it { is_expected.to remove_package('haproxy') }
+  end
+
+  context 'remove haproxy installed from source' do
+    recipe do
+      haproxy_install 'source' do
+        action :remove
+      end
+    end
+
+    it { is_expected.to delete_file('/usr/sbin/haproxy') }
+    it { is_expected.to delete_file('/usr/share/man/man1/haproxy.1') }
+    it do
+      is_expected.to delete_file(
+        ::File.join(Chef::Config[:file_cache_path], 'haproxy-3.2.14.tar.gz')
+      )
+    end
+
+    it do
+      is_expected.to delete_directory(
+        ::File.join(Chef::Config[:file_cache_path], 'haproxy-3.2.14')
+      )
+    end
+  end
+
   context 'compile HAProxy on Ubuntu' do
     recipe do
       haproxy_install 'source' do
@@ -24,13 +58,27 @@
       end
     end
     before(:each) do
-      stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5')
+      stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14')
     end
 
     it { is_expected.to install_package(%w(libpcre3-dev libssl-dev zlib1g-dev libsystemd-dev)) }
     it { is_expected.not_to install_package('pcre-devel') }
   end
 
+  context 'compile HAProxy on Debian 13 (uses PCRE2)' do
+    platform 'debian', '13'
+
+    recipe do
+      haproxy_install 'source'
+    end
+    before(:each) do
+      stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14')
+    end
+
+    it { is_expected.to install_package(%w(libpcre2-dev libssl-dev zlib1g-dev libsystemd-dev)) }
+    it { is_expected.not_to install_package('libpcre3-dev') }
+  end
+
   context 'compile HAProxy on AlmaLinux 9' do
     platform 'almalinux', '9'
 
@@ -38,21 +86,21 @@
       haproxy_install 'source'
     end
     before(:each) do
-      stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5')
+      stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14')
     end
 
     it { is_expected.to install_package(%w(pcre-devel openssl-devel zlib-devel systemd-devel tar)) }
     it { is_expected.not_to install_package('pcre2-devel') }
   end
 
-  context 'compile HAProxy on AlmaLinux 10 (uses PCRE2)' do
+  context 'compile HAProxy on AlmaLinux >= 10 (uses PCRE2)' do
     platform 'almalinux', '10'
 
     recipe do
       haproxy_install 'source'
     end
     before(:each) do
-      stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5')
+      stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14')
     end
 
     it { is_expected.to install_package(%w(pcre2-devel openssl-devel zlib-devel systemd-devel tar)) }
@@ -66,7 +114,7 @@
       haproxy_install 'source'
     end
     before(:each) do
-      stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5')
+      stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14')
     end
 
     it { is_expected.to install_package(%w(pcre-devel openssl-devel zlib-devel systemd-devel tar)) }
@@ -80,7 +128,7 @@
       haproxy_install 'source'
     end
     before(:each) do
-      stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5')
+      stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14')
     end
 
     it { is_expected.to install_package(%w(pcre-devel openssl-devel zlib-devel systemd-devel tar)) }
@@ -96,7 +144,7 @@
       end
     end
     before(:each) do
-      stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return(false)
+      stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return(false)
     end
 
     # When PCRE is disabled, we still install the package (for dependencies)
@@ -122,7 +170,7 @@
       end
     end
     before(:each) do
-      stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return(false)
+      stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return(false)
     end
 
     it 'includes RPATH in the compilation command' do
diff --git a/spec/unit/recipes/listen_spec.rb b/spec/unit/resources/listen_spec.rb
similarity index 92%
rename from spec/unit/recipes/listen_spec.rb
rename to spec/unit/resources/listen_spec.rb
index ec035307..ac05b1b3 100644
--- a/spec/unit/recipes/listen_spec.rb
+++ b/spec/unit/resources/listen_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_listen' do
@@ -29,14 +31,18 @@
       '  stats realm Haproxy-Statistics',
       '  stats auth user:pwd',
       '  http-request add-header X-Proto http',
-      '  http-response set-header Expires %\[date\(3600\),http_date]',
+      '  http-response set-header Expires %[date(3600),http_date]',
       '  default_backend servers',
       '  bind-process odd',
       '  server admin0 10.0.0.10:80 check weight 1 maxconn 100',
       '  server admin1 10.0.0.10:80 check weight 1 maxconn 100',
     ]
 
-    it { is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(/#{cfg_content.join('\n')}/) }
+    it do
+      is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(
+        Regexp.new(Regexp.escape(cfg_content.join("\n")))
+      )
+    end
   end
 
   context 'option parameter with array of options' do
diff --git a/spec/unit/recipes/mailer_spec.rb b/spec/unit/resources/mailer_spec.rb
similarity index 97%
rename from spec/unit/recipes/mailer_spec.rb
rename to spec/unit/resources/mailer_spec.rb
index 752effde..1fcdc650 100644
--- a/spec/unit/recipes/mailer_spec.rb
+++ b/spec/unit/resources/mailer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_mailer' do
diff --git a/spec/unit/recipes/peer_spec.rb b/spec/unit/resources/peer_spec.rb
similarity index 97%
rename from spec/unit/recipes/peer_spec.rb
rename to spec/unit/resources/peer_spec.rb
index d146ba61..ec994122 100644
--- a/spec/unit/recipes/peer_spec.rb
+++ b/spec/unit/resources/peer_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe 'haproxy_peer' do
diff --git a/spec/unit/resources/service_spec.rb b/spec/unit/resources/service_spec.rb
new file mode 100644
index 00000000..6c4cff8b
--- /dev/null
+++ b/spec/unit/resources/service_spec.rb
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'haproxy_service' do
+  step_into :haproxy_service
+  platform 'ubuntu', '24.04'
+
+  context 'with action :create' do
+    recipe do
+      haproxy_service 'haproxy' do
+        action :create
+      end
+    end
+
+    it do
+      is_expected.to create_file('/etc/default/haproxy').with(
+        content: '',
+        owner: 'root',
+        group: 'root',
+        mode: '0644'
+      )
+    end
+
+    it { is_expected.to create_systemd_unit('haproxy.service') }
+  end
+
+  context 'with action :delete' do
+    recipe do
+      haproxy_service 'haproxy' do
+        action :delete
+      end
+    end
+
+    it { is_expected.to delete_file('/etc/default/haproxy') }
+    it { is_expected.to delete_systemd_unit('haproxy.service') }
+  end
+
+  context 'with action :start and configuration testing disabled' do
+    recipe do
+      haproxy_service 'haproxy' do
+        config_test false
+        action :start
+      end
+    end
+
+    it { is_expected.to start_systemd_unit('haproxy.service') }
+  end
+end
diff --git a/templates/default/haproxy.cfg.erb b/templates/default/haproxy.cfg.erb
index 98531115..5e3f5bc6 100644
--- a/templates/default/haproxy.cfg.erb
+++ b/templates/default/haproxy.cfg.erb
@@ -64,6 +64,7 @@ resolvers <%= resolver %>
 <% end -%>
 <% end -%>
 <% end -%>
+<% unless nil_or_empty?(r['extra_options']) %>
 <% r['extra_options'].each do | option, value | -%>
 <% if value.is_a?(Array) %>
 <% value.each do | array_element | %>
@@ -75,6 +76,7 @@ resolvers <%= resolver %>
 <% end -%>
 <% end -%>
 <% end -%>
+<% end -%>
 <% unless nil_or_empty?(@defaults) %>
 
 
diff --git a/test/cookbooks/test/metadata.rb b/test/cookbooks/test/metadata.rb
index b544d8c4..0fbc4564 100644
--- a/test/cookbooks/test/metadata.rb
+++ b/test/cookbooks/test/metadata.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 name              'test'
 maintainer        'Heavy Water Software Inc.'
 maintainer_email  'ops@hw-ops.com'
diff --git a/test/cookbooks/test/recipes/config_3.rb b/test/cookbooks/test/recipes/config_3.rb
index 852aa51d..1175a91a 100644
--- a/test/cookbooks/test/recipes/config_3.rb
+++ b/test/cookbooks/test/recipes/config_3.rb
@@ -34,8 +34,6 @@
   http_response 'set-header Expires %[date(3600),http_date]'
   default_backend 'servers'
   option %w(dontlog-normal)
-  # bind-process is deprecated in HAProxy 2.5+ and removed in 3.x
-  extra_options('bind-process' => 'odd') unless node['platform_version'].to_i >= 10
   hash_type 'consistent'
 end
 
diff --git a/test/cookbooks/test/recipes/default.rb b/test/cookbooks/test/recipes/default.rb
new file mode 100644
index 00000000..85dbd814
--- /dev/null
+++ b/test/cookbooks/test/recipes/default.rb
@@ -0,0 +1,20 @@
+apt_update
+
+haproxy_install 'package'
+
+haproxy_config_global ''
+
+haproxy_config_defaults ''
+
+haproxy_frontend 'http-in' do
+  default_backend 'servers'
+end
+
+haproxy_backend 'servers' do
+  server ['server1 127.0.0.1:8000 maxconn 32']
+  notifies :restart, 'haproxy_service[haproxy]', :immediately
+end
+
+haproxy_service 'haproxy' do
+  action %i(create enable start)
+end
diff --git a/test/cookbooks/test/recipes/source_24.rb b/test/cookbooks/test/recipes/source_24.rb
deleted file mode 100644
index b9efc2cb..00000000
--- a/test/cookbooks/test/recipes/source_24.rb
+++ /dev/null
@@ -1,24 +0,0 @@
-# renovate: datasource=endoflife-date depName=haproxy versioning=semver
-version = '2.4.25'
-
-haproxy_install 'source' do
-  source_url "https://www.haproxy.org/download/#{version.to_f}/src/haproxy-#{version}.tar.gz"
-  source_checksum '44b035bdc9ffd4935f5292c2dfd4a1596c048dc59c5b25a0c6d7689d64f50b99'
-  source_version version
-  use_libcrypt true
-  use_pcre true
-  use_openssl true
-  use_zlib true
-  use_promex true
-  use_linux_tproxy true
-  use_linux_splice true
-end
-
-haproxy_config_global ''
-
-haproxy_config_defaults ''
-
-haproxy_service 'haproxy' do
-  action :create
-  delayed_action %i(enable start)
-end
diff --git a/test/cookbooks/test/recipes/source_26.rb b/test/cookbooks/test/recipes/source_26.rb
deleted file mode 100644
index 906ee393..00000000
--- a/test/cookbooks/test/recipes/source_26.rb
+++ /dev/null
@@ -1,22 +0,0 @@
-# renovate: datasource=endoflife-date depName=haproxy versioning=semver
-version = '2.6.16'
-
-haproxy_install 'source' do
-  source_url "https://www.haproxy.org/download/#{version.to_f}/src/haproxy-#{version}.tar.gz"
-  source_checksum 'faac6f9564caf6e106fe22c77a1fb35406afc8cd484c35c2c844aaf0d7a097fb'
-  source_version version
-  use_libcrypt true
-  use_pcre true
-  use_openssl true
-  use_zlib true
-  use_linux_tproxy true
-  use_linux_splice true
-end
-
-haproxy_config_global ''
-
-haproxy_config_defaults ''
-
-haproxy_service 'haproxy' do
-  action %i(create enable start)
-end
diff --git a/test/cookbooks/test/recipes/source_28.rb b/test/cookbooks/test/recipes/source_32.rb
similarity index 80%
rename from test/cookbooks/test/recipes/source_28.rb
rename to test/cookbooks/test/recipes/source_32.rb
index 5ca0d236..2c41f94f 100644
--- a/test/cookbooks/test/recipes/source_28.rb
+++ b/test/cookbooks/test/recipes/source_32.rb
@@ -1,9 +1,11 @@
+apt_update
+
 # renovate: datasource=endoflife-date depName=haproxy versioning=semver
-version = '2.8.5'
+version = '3.2.14'
 
 haproxy_install 'source' do
   source_url "https://www.haproxy.org/download/#{version.to_f}/src/haproxy-#{version}.tar.gz"
-  source_checksum '3f5459c5a58e0b343a32eaef7ed5bed9d3fc29d8aa9e14b36c92c969fc2a60d9'
+  source_checksum 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4'
   source_version version
   use_libcrypt true
   use_pcre true
diff --git a/test/cookbooks/test/recipes/source_lua.rb b/test/cookbooks/test/recipes/source_lua.rb
index 4e6284c7..aaf57517 100644
--- a/test/cookbooks/test/recipes/source_lua.rb
+++ b/test/cookbooks/test/recipes/source_lua.rb
@@ -1,3 +1,5 @@
+apt_update
+
 build_essential 'compilation tools'
 
 # install lua dependencies
diff --git a/test/cookbooks/test/recipes/source_openssl.rb b/test/cookbooks/test/recipes/source_openssl.rb
index 78bffc8b..826223ef 100644
--- a/test/cookbooks/test/recipes/source_openssl.rb
+++ b/test/cookbooks/test/recipes/source_openssl.rb
@@ -1,25 +1,31 @@
-build_essential 'compilation tools'
-
-# package %w(build-essential zlib1g-dev) if platform_family?('debian')
+apt_update
 
-# Install perl modules for OpenSSL configure script on RHEL/CentOS >= 10
-package %w(perl-FindBin perl-lib perl-File-Compare perl-File-Copy perl-IPC-Cmd perl-Pod-Html) if platform_family?('rhel', 'fedora') && node['platform_version'].to_i >= 10
-
-# package %w(make gcc perl pcre-devel zlib-devel perl-core) if platform_family?('rhel')
+build_essential 'compilation tools'
 
-# override environment variable
-ruby_block 'Pre-load OpenSSL path' do
-  block do
-    ENV['PATH'] = "/usr/local/openssl/bin:#{ENV['PATH']}"
+# Install dependencies needed by OpenSSL Configure and compilation
+case node['platform_family']
+when 'rhel', 'fedora'
+  if node['platform_version'].to_i >= 9
+    package %w(perl-FindBin perl-lib perl-File-Compare perl-File-Copy perl-IPC-Cmd perl-Pod-Html perl-Time-Piece)
+  else
+    # EL8 bundles perl modules in perl-core, individual packages don't exist
+    package 'perl-core' do
+      not_if { ::File.exist?('/usr/bin/perl') }
+    end
+    package 'perl-IPC-Cmd'
   end
+when 'debian'
+  package %w(perl zlib1g-dev)
+when 'suse'
+  package %w(perl zlib-devel)
 end
 
-openssl_version = '3.2.1'
+openssl_version = '3.5.5'
 
 # download openssl
 remote_file "#{Chef::Config[:file_cache_path]}/openssl-#{openssl_version}.tar.gz" do
-  source "https://www.openssl.org/source/openssl-#{openssl_version}.tar.gz"
-  checksum '83c7329fe52c850677d75e5d0b0ca245309b97e8ecbcfdc1dfdc4ab9fac35b39'
+  source "https://github.com/openssl/openssl/releases/download/openssl-#{openssl_version}/openssl-#{openssl_version}.tar.gz"
+  checksum 'b28c91532a8b65a1f983b4c28b7488174e4a01008e29ce8e69bd789f28bc2a89'
 end
 
 # extract openssl
@@ -31,7 +37,7 @@
 # compile openssl
 execute "package_openssl-#{openssl_version}" do
   command <<-COMPILE
-    ./config --prefix=/usr/local/openssl/ --openssldir=/usr/local/openssl/ shared zlib
+    ./config --prefix=/usr/local/openssl/ --openssldir=/usr/local/openssl/ --libdir=lib shared zlib
     make
     make install
   COMPILE
diff --git a/test/cookbooks/test/recipes/source_28_pcre2.rb b/test/cookbooks/test/recipes/source_pcre2.rb
similarity index 72%
rename from test/cookbooks/test/recipes/source_28_pcre2.rb
rename to test/cookbooks/test/recipes/source_pcre2.rb
index b8cbddb4..74fb7769 100644
--- a/test/cookbooks/test/recipes/source_28_pcre2.rb
+++ b/test/cookbooks/test/recipes/source_pcre2.rb
@@ -1,9 +1,12 @@
-version = '2.8.5'
+apt_update
+
+# renovate: datasource=endoflife-date depName=haproxy versioning=semver
+version = '3.2.14'
 
 # Test recipe for RHEL/CentOS platforms version 10 and above (uses PCRE2)
 haproxy_install 'source' do
   source_url "https://www.haproxy.org/download/#{version.to_f}/src/haproxy-#{version}.tar.gz"
-  source_checksum '3f5459c5a58e0b343a32eaef7ed5bed9d3fc29d8aa9e14b36c92c969fc2a60d9'
+  source_checksum 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4'
   source_version version
   # Rely on auto-detection for PCRE2 on RHEL >= 10
   use_libcrypt true
diff --git a/test/integration/common/inspec.yml b/test/integration/common/inspec.yml
index a54e1b83..81e6ef14 100644
--- a/test/integration/common/inspec.yml
+++ b/test/integration/common/inspec.yml
@@ -2,6 +2,3 @@
 name: haproxy-common
 title: HAProxy Common Suite
 summary: HAProxy common tests
-supports:
-  - os-family: linux
-  - os-family: bsd
diff --git a/test/integration/config_2/inspec.yml b/test/integration/config_2/inspec.yml
index f6b17010..19f9a50d 100644
--- a/test/integration/config_2/inspec.yml
+++ b/test/integration/config_2/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-2
 title: HAProxy Config 2 Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/config_3/controls/config_spec.rb b/test/integration/config_3/controls/config_spec.rb
index e0b26776..26c3b273 100644
--- a/test/integration/config_3/controls/config_spec.rb
+++ b/test/integration/config_3/controls/config_spec.rb
@@ -72,14 +72,9 @@
   '  http-response set-header Expires %\[date\(3600\),http_date\]',
   '  default_backend servers',
   '  option dontlog-normal',
+  '  hash-type consistent',
 ]
 
-platform_version = os.release.to_i
-if platform_version < 10
-  cfg_content << '  bind-process odd'
-end
-cfg_content << '  hash-type consistent'
-
 describe file('/etc/haproxy/haproxy.cfg') do
   its('content') { should match(/#{cfg_content.join('\n')}/) }
 end
diff --git a/test/integration/config_3/inspec.yml b/test/integration/config_3/inspec.yml
index 30ee033a..49a90f5d 100644
--- a/test/integration/config_3/inspec.yml
+++ b/test/integration/config_3/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-3
 title: HAProxy Config 3 Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/config_acl/inspec.yml b/test/integration/config_acl/inspec.yml
index 8229b1f3..d4011d09 100644
--- a/test/integration/config_acl/inspec.yml
+++ b/test/integration/config_acl/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-acl
 title: HAProxy Config ACL Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/config_array/inspec.yml b/test/integration/config_array/inspec.yml
index 2cd4e58a..1f17eb26 100644
--- a/test/integration/config_array/inspec.yml
+++ b/test/integration/config_array/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-array
 title: HAProxy Config Array Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/config_backend_search/inspec.yml b/test/integration/config_backend_search/inspec.yml
index b04dbb42..2481bc46 100644
--- a/test/integration/config_backend_search/inspec.yml
+++ b/test/integration/config_backend_search/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-backend-search
 title: HAProxy Config Backend Search Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/config_custom_template/inspec.yml b/test/integration/config_custom_template/inspec.yml
index 76a88404..6c3d9a9f 100644
--- a/test/integration/config_custom_template/inspec.yml
+++ b/test/integration/config_custom_template/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-custom-template
 title: HAProxy Config Custom Template Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/config_fastcgi/inspec.yml b/test/integration/config_fastcgi/inspec.yml
index f82aa3b5..50e4d5bf 100644
--- a/test/integration/config_fastcgi/inspec.yml
+++ b/test/integration/config_fastcgi/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-fast-csgi
 title: HAProxy Config FastCGI Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/config_resolver/inspec.yml b/test/integration/config_resolver/inspec.yml
index 1e05e069..0ba379f0 100644
--- a/test/integration/config_resolver/inspec.yml
+++ b/test/integration/config_resolver/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-resolver
 title: HAProxy Config Resolver Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/config_ssl_redirect/inspec.yml b/test/integration/config_ssl_redirect/inspec.yml
index 69a7304a..3b1eaa18 100644
--- a/test/integration/config_ssl_redirect/inspec.yml
+++ b/test/integration/config_ssl_redirect/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-config-ssl-redirect
 title: HAProxy Config SSL Redirect Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/source_2.6/controls/source_spec.rb b/test/integration/default/controls/default_spec.rb
similarity index 100%
rename from test/integration/source_2.6/controls/source_spec.rb
rename to test/integration/default/controls/default_spec.rb
diff --git a/test/integration/default/inspec.yml b/test/integration/default/inspec.yml
new file mode 100644
index 00000000..a99dfb97
--- /dev/null
+++ b/test/integration/default/inspec.yml
@@ -0,0 +1,7 @@
+---
+name: haproxy-default
+title: HAProxy Default Suite
+summary: HAProxy default tests using package installation
+depends:
+  - name: haproxy-common
+    path: test/integration/common
diff --git a/test/integration/nodes/be-1.json b/test/integration/nodes/be-1.json
index ccdb84a2..75d54585 100644
--- a/test/integration/nodes/be-1.json
+++ b/test/integration/nodes/be-1.json
@@ -1,9 +1,10 @@
 {
   "id": "be-1",
+  "chef_environment": "local",
   "run_list": ["role[app]"],
   "automatic": {
     "hostname": "be-1",
     "ipaddress": "10.0.0.75",
     "roles": ["app"]
   }
-}
\ No newline at end of file
+}
diff --git a/test/integration/nodes/be-2.json b/test/integration/nodes/be-2.json
index 332e5839..70778858 100644
--- a/test/integration/nodes/be-2.json
+++ b/test/integration/nodes/be-2.json
@@ -1,9 +1,10 @@
-{
-  "id": "be-2",
-  "run_list": ["role[app]"],
-  "automatic": {
-    "hostname": "be-2",
-    "ipaddress": "10.0.0.76",
-    "roles": ["app"]
-  }
-}
\ No newline at end of file
+{
+  "id": "be-2",
+  "chef_environment": "local",
+  "run_list": ["role[app]"],
+  "automatic": {
+    "hostname": "be-2",
+    "ipaddress": "10.0.0.76",
+    "roles": ["app"]
+  }
+}
diff --git a/test/integration/package/inspec.yml b/test/integration/package/inspec.yml
index 456dce74..f8fd87cb 100644
--- a/test/integration/package/inspec.yml
+++ b/test/integration/package/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-package
 title: HAProxy Package Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/source-default/inspec.yml b/test/integration/source-default/inspec.yml
index 093a205a..7b4fe336 100644
--- a/test/integration/source-default/inspec.yml
+++ b/test/integration/source-default/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-source-default
 title: HAProxy Source Default
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/source_2.4/controls/source_spec.rb b/test/integration/source_2.4/controls/source_spec.rb
deleted file mode 100644
index 77ff540e..00000000
--- a/test/integration/source_2.4/controls/source_spec.rb
+++ /dev/null
@@ -1,5 +0,0 @@
-include_controls 'haproxy-common'
-
-describe command('haproxy -vv') do
-  its('stdout') { should match(/Built with the Prometheus exporter as a service/) }
-end
diff --git a/test/integration/source_2.6/inspec.yml b/test/integration/source_2.6/inspec.yml
deleted file mode 100644
index 6c094f54..00000000
--- a/test/integration/source_2.6/inspec.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-name: haproxy-source-2.6
-title: HAProxy Source Suite
-summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
-depends:
-  - name: haproxy-common
-    path: test/integration/common
diff --git a/test/integration/source_2.8/inspec.yml b/test/integration/source_2.8/inspec.yml
deleted file mode 100644
index b1d374f9..00000000
--- a/test/integration/source_2.8/inspec.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-name: haproxy-source-2.8
-title: HAProxy Source Suite
-summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
-depends:
-  - name: haproxy-common
-    path: test/integration/common
diff --git a/test/integration/source_2.9/controls/source_spec.rb b/test/integration/source_2.9/controls/source_spec.rb
deleted file mode 100644
index 67a82c01..00000000
--- a/test/integration/source_2.9/controls/source_spec.rb
+++ /dev/null
@@ -1 +0,0 @@
-include_controls 'haproxy-common'
diff --git a/test/integration/source_2.9/inspec.yml b/test/integration/source_2.9/inspec.yml
deleted file mode 100644
index fa522a8d..00000000
--- a/test/integration/source_2.9/inspec.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-name: haproxy-source-2.9
-title: HAProxy Source Suite
-summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
-depends:
-  - name: haproxy-common
-    path: test/integration/common
diff --git a/test/integration/source_2.8/controls/source_spec.rb b/test/integration/source_3.2/controls/source_spec.rb
similarity index 100%
rename from test/integration/source_2.8/controls/source_spec.rb
rename to test/integration/source_3.2/controls/source_spec.rb
diff --git a/test/integration/source_2.4/inspec.yml b/test/integration/source_3.2/inspec.yml
similarity index 66%
rename from test/integration/source_2.4/inspec.yml
rename to test/integration/source_3.2/inspec.yml
index 5f9adb80..f1d912fb 100644
--- a/test/integration/source_2.4/inspec.yml
+++ b/test/integration/source_3.2/inspec.yml
@@ -1,10 +1,7 @@
 ---
-name: haproxy-source-2.4
+name: haproxy-source-3.2
 title: HAProxy Source Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/source_lua/inspec.yml b/test/integration/source_lua/inspec.yml
index 8c4969df..84f6afcd 100644
--- a/test/integration/source_lua/inspec.yml
+++ b/test/integration/source_lua/inspec.yml
@@ -2,9 +2,6 @@
 name: haproxy-source-lua
 title: HAProxy Source Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
 depends:
   - name: haproxy-common
     path: test/integration/common
diff --git a/test/integration/source_openssl/controls/openssl_spec.rb b/test/integration/source_openssl/controls/openssl_spec.rb
index 29ec3a52..7ed70339 100644
--- a/test/integration/source_openssl/controls/openssl_spec.rb
+++ b/test/integration/source_openssl/controls/openssl_spec.rb
@@ -1,5 +1,3 @@
-include_controls 'haproxy-common'
-
 describe file '/usr/bin/openssl' do
   it { should exist }
 end
@@ -9,5 +7,5 @@
 end
 
 describe command('haproxy -vv') do
-  its('stdout') { should match(/OpenSSL version : OpenSSL 3.2.1/) }
+  its('stdout') { should match(/OpenSSL version : OpenSSL 3.5.5/) }
 end
diff --git a/test/integration/source_openssl/inspec.yml b/test/integration/source_openssl/inspec.yml
index ae510e42..f5b8fd5c 100644
--- a/test/integration/source_openssl/inspec.yml
+++ b/test/integration/source_openssl/inspec.yml
@@ -2,9 +2,4 @@
 name: haproxy-open-ssl
 title: HAProxy OpenSSL Suite
 summary: HAProxy tests using example configuration
-supports:
-  - os-family: linux
-  - os-family: bsd
-depends:
-  - name: haproxy-common
-    path: test/integration/common
+depends: []