diff --git a/.github/workflows/build-and-optionally-test-wheels-on-one-platform.yml b/.github/workflows/build-and-optionally-test-wheels-on-one-platform.yml
index b1ef0e697b..2059ef35c3 100644
--- a/.github/workflows/build-and-optionally-test-wheels-on-one-platform.yml
+++ b/.github/workflows/build-and-optionally-test-wheels-on-one-platform.yml
@@ -107,7 +107,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -124,8 +124,8 @@ jobs:
         echo "runner_os=${hashmap[$PLATFORM_TAG]}" >> "$GITHUB_OUTPUT"
 
         declare -A manylinux_digest
-        manylinux_digest[manylinux_x86_64]="6d32fb959e76ed2b2117b28d141b3a92aed81805fe23e357a9b247ea30b88ae5"
-        manylinux_digest[manylinux_aarch64]="3e814781f3025a4659eefdc2aa1dca593eb1d9e0d6c6e1d1f543d17429eb5bdb"
+        manylinux_digest[manylinux_x86_64]="ee086a7e0d988b829bebe6404125c682190ea336ab3aad17f0c90623b28e2708"
+        manylinux_digest[manylinux_aarch64]="183ccef2e4047f722b179d69dde14b99e05b7234724bf00aa31657ae695743f5"
         # This will not fail if map key is not found. Assuming only a blank string will be returned
         echo "manylinux_image_digest=${manylinux_digest[$PLATFORM_TAG]}" >> "$GITHUB_OUTPUT"
       # Bash >= 4 supports hashmaps
@@ -178,7 +178,7 @@ jobs:
       use-sanitizer-wheel: ${{ contains(inputs.env-vars-for-building, 'SANITIZER') }}
       run-tests-in-container: ${{ contains(inputs.platform-tag, 'manylinux') }}
       # Only used if running tests in container
-      container-image-name: ${{ vars.JF_EXTERNAL_URL }}/${{ vars.JFROG_PROJECT_FOR_CLIENT_TEAM }}-docker-dev-local/manylinux_2_28_${{ endsWith(inputs.platform-tag, 'x86_64') && 'x86_64' || 'aarch64' }}@sha256:${{ needs.get-build-runner-os.outputs.manylinux-image-digest }}
+      container-image-name: ${{ vars.JF_EXTERNAL_URL }}/${{ vars.JFROG_REPO_FOR_CUSTOM_MANYLINUX_IMAGES }}/manylinux_2_28_${{ endsWith(inputs.platform-tag, 'x86_64') && 'x86_64' || 'aarch64' }}@sha256:${{ needs.get-build-runner-os.outputs.manylinux-image-digest }}
       server-tag: ${{ inputs.server-tag }}
       run-integration-tests: ${{ inputs.platform-tag != 'macosx_x86_64' || inputs.run-integration-tests-on-macos-x86 }}
       test-file: ${{ inputs.test-file }}
diff --git a/.github/workflows/build-sdist.yml b/.github/workflows/build-sdist.yml
index b173caae6f..82eef0ffc1 100644
--- a/.github/workflows/build-sdist.yml
+++ b/.github/workflows/build-sdist.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/decide-to-run-integration-tests.yml b/.github/workflows/decide-to-run-integration-tests.yml
index 14a484ba2e..da8d004e3f 100644
--- a/.github/workflows/decide-to-run-integration-tests.yml
+++ b/.github/workflows/decide-to-run-integration-tests.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/dev-workflow.yml b/.github/workflows/dev-workflow.yml
index 1dbe4b8441..05b263a7de 100644
--- a/.github/workflows/dev-workflow.yml
+++ b/.github/workflows/dev-workflow.yml
@@ -43,7 +43,7 @@ jobs:
       contents: read
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/doc-tests.yml b/.github/workflows/doc-tests.yml
index 1591ac5538..d3fef46f74 100644
--- a/.github/workflows/doc-tests.yml
+++ b/.github/workflows/doc-tests.yml
@@ -34,10 +34,11 @@ jobs:
         builder-command:
         - 'spelling . spelling -W --keep-going'
         # -vv is too verbose and makes it hard to read logs
-        - 'linkcheck -v . links'
+        # TODO: disabled because this is flakey and causes false positives
+        # - 'linkcheck -v . links'
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/fast-forward-merge.yml b/.github/workflows/fast-forward-merge.yml
index 8613ddbb5c..641f1c548a 100644
--- a/.github/workflows/fast-forward-merge.yml
+++ b/.github/workflows/fast-forward-merge.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/get-latest-release-bundle.yml b/.github/workflows/get-latest-release-bundle.yml
index 49d79e52bf..6b0c5829af 100644
--- a/.github/workflows/get-latest-release-bundle.yml
+++ b/.github/workflows/get-latest-release-bundle.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0f1bb676b2..1dc1a08b1e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/smoke-tests.yml b/.github/workflows/smoke-tests.yml
index d0f857877a..0161c293d8 100644
--- a/.github/workflows/smoke-tests.yml
+++ b/.github/workflows/smoke-tests.yml
@@ -68,7 +68,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -202,7 +202,7 @@ jobs:
       COVERAGE_REPORT_DIR: coverage-report
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -242,7 +242,7 @@ jobs:
     runs-on: ${{ needs.build.outputs.runner-os-used-for-build }}
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -379,7 +379,7 @@ jobs:
     runs-on: ${{ needs.build.outputs.runner-os-used-for-build }}
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -414,7 +414,7 @@ jobs:
     runs-on: ${{ needs.build.outputs.runner-os-used-for-build }}
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/stage-workflow.yml b/.github/workflows/stage-workflow.yml
index 5876e6cd41..f5d6496b58 100644
--- a/.github/workflows/stage-workflow.yml
+++ b/.github/workflows/stage-workflow.yml
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/test-artifact.yml b/.github/workflows/test-artifact.yml
index eb688e9978..d8d54d7ffd 100644
--- a/.github/workflows/test-artifact.yml
+++ b/.github/workflows/test-artifact.yml
@@ -75,7 +75,7 @@ jobs:
       REPO_DIR_NAME: aerospike-client-python
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
@@ -160,7 +160,7 @@ jobs:
     - if: ${{ !inputs.run-tests-in-container }}
       name: 'Bare metal: install wheel and perform extra test setup steps'
       run: |
-        pip install "./$ARTIFACT_FILE_NAME"
+        python3 -m pip install "./$ARTIFACT_FILE_NAME"
 
         if [[ ${{ inputs.run-integration-tests }} == false ]]; then
           exit 0
@@ -226,7 +226,7 @@ jobs:
         if [[ ${{ inputs.validate-keys }} == false ]]; then
           crudini --existing=param --set config.conf input-validation validate_keys false
         fi
-        pip install -r requirements.txt
+        python3 -m pip install -r requirements.txt
 
         VALGRIND_ARGS=()
         if [[ ${{ inputs.run-with-valgrind }} == true ]]; then
@@ -356,7 +356,11 @@ jobs:
         docker exec --workdir "/$REPO_DIR_NAME" "$LINUX_DISTRO_CONTAINER_NAME" "python${PYTHON_VERSION}" -m $PIP_INSTALL_COMMAND "./$ARTIFACT_FILE_NAME"
         # shellcheck disable=SC2086
         docker exec --workdir "/$REPO_DIR_NAME/test" "$LINUX_DISTRO_CONTAINER_NAME" "python${PYTHON_VERSION}" -m $PIP_INSTALL_COMMAND -r requirements.txt
-        docker exec --workdir "/$REPO_DIR_NAME/test" "$LINUX_DISTRO_CONTAINER_NAME" "python${PYTHON_VERSION}" -m pytest "new_tests/$TEST_FILE"
+
+        # eval: perform variable expansion before brace expansion
+        read -ra test_files < <(eval echo "new_tests/$TEST_FILE")
+
+        docker exec --workdir "/$REPO_DIR_NAME/test" "$LINUX_DISTRO_CONTAINER_NAME" "python${PYTHON_VERSION}" -m pytest "${test_files[@]}"
       shell: bash -ex {0}
       env:
         IS_DISTRO_CONTAINER_DNF_BASED: ${{ inputs.container-image-name == 'amazonlinux:2023' || contains(inputs.container-image-name, 'ubi') }}
diff --git a/.github/workflows/update-manylinux-openssl-image.yml b/.github/workflows/update-manylinux-openssl-image.yml
index 163db5612a..992be10a25 100644
--- a/.github/workflows/update-manylinux-openssl-image.yml
+++ b/.github/workflows/update-manylinux-openssl-image.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ${{ matrix.arch-and-runner-os[1] }}
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/update-version.yml b/.github/workflows/update-version.yml
index 2cff928fcc..aa2d94cf37 100644
--- a/.github/workflows/update-version.yml
+++ b/.github/workflows/update-version.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/upload-jfrog-build-to-pypi.yml b/.github/workflows/upload-jfrog-build-to-pypi.yml
index 0dcc08cbba..f3b9038f7b 100644
--- a/.github/workflows/upload-jfrog-build-to-pypi.yml
+++ b/.github/workflows/upload-jfrog-build-to-pypi.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: audit