diff --git a/.github/template_gitref b/.github/template_gitref
index 2b533f2f5..e456a48e1 100644
--- a/.github/template_gitref
+++ b/.github/template_gitref
@@ -1 +1 @@
-2021.08.26-315-g8ecb63d
+2021.08.26-316-g69ef1f6
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a4f529139..1e0022ca8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,7 +25,7 @@ jobs:
           path: "pulp_rpm"
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
       - name: "Install python dependencies"
         run: |
           echo ::group::PYDEPS
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 584f7d71e..5059d7eb6 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -30,7 +30,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e5be081e1..a7a4a8f58 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
           path: "pulp_rpm"
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
       - name: "Install python dependencies"
         run: |
           echo ::group::PYDEPS
diff --git a/.github/workflows/create-branch.yml b/.github/workflows/create-branch.yml
index 1891281e5..18a28b3f1 100644
--- a/.github/workflows/create-branch.yml
+++ b/.github/workflows/create-branch.yml
@@ -28,7 +28,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8c7bdbab2..75975dd22 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -26,7 +26,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 3402cdf0b..2e2d430ff 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -83,7 +83,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
@@ -152,7 +152,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Set environment variables"
         run: |
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e3073d443..c2ab82caa 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -41,7 +41,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - uses: "actions/download-artifact@v3"
         with:
@@ -152,7 +152,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
@@ -195,7 +195,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
@@ -265,7 +265,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1e44b1205..24d63f60f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
diff --git a/.github/workflows/scripts/install.sh b/.github/workflows/scripts/install.sh
index d7a5c6c79..b3a9f0bd8 100755
--- a/.github/workflows/scripts/install.sh
+++ b/.github/workflows/scripts/install.sh
@@ -172,10 +172,17 @@ cat "$CERTIFI" | sudo tee -a "$CERT" > /dev/null
 sudo update-ca-certificates
 echo ::endgroup::
 
+# Add our azcert.crt certificate to the container image along with the certificates from certifi
+# so that we can use HTTPS with our fake Azure CI. certifi is self-contained and doesn't allow
+# extension or modification of the trust store, so we do a weird and hacky thing (above) where we just
+# overwrite or append to certifi's trust store behind it's back.
+#
+# We do this for both the CI host and the CI image.
 if [[ "$TEST" = "azure" ]]; then
   AZCERTIFI=$(/opt/az/bin/python3 -c 'import certifi; print(certifi.where())')
+  PULPCERTIFI=$(cmd_prefix python3 -c 'import certifi; print(certifi.where())')
   cat /usr/local/share/ca-certificates/azcert.crt >> $AZCERTIFI
-  cat /usr/local/share/ca-certificates/azcert.crt | cmd_stdin_prefix tee -a /usr/local/lib/python3.8/site-packages/certifi/cacert.pem > /dev/null
+  cat /usr/local/share/ca-certificates/azcert.crt | cmd_stdin_prefix tee -a "$PULPCERTIFI" > /dev/null
   cat /usr/local/share/ca-certificates/azcert.crt | cmd_stdin_prefix tee -a /etc/pki/tls/cert.pem > /dev/null
   AZURE_STORAGE_CONNECTION_STRING='DefaultEndpointsProtocol=https;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=https://ci-azurite:10000/devstoreaccount1;'
   az storage container create --name pulp-test --connection-string $AZURE_STORAGE_CONNECTION_STRING
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4785df3c4..67e08b222 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -41,7 +41,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - uses: "actions/download-artifact@v3"
         with:
diff --git a/.github/workflows/update-labels.yml b/.github/workflows/update-labels.yml
index 069d3ba69..a2c6d99ba 100644
--- a/.github/workflows/update-labels.yml
+++ b/.github/workflows/update-labels.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
       - name: "Configure Git with pulpbot name and email"
         run: |
           git config --global user.name 'pulpbot'
diff --git a/.github/workflows/update_ci.yml b/.github/workflows/update_ci.yml
index 26f4804d1..691c08dc9 100644
--- a/.github/workflows/update_ci.yml
+++ b/.github/workflows/update_ci.yml
@@ -31,7 +31,7 @@ jobs:
 
       - uses: "actions/setup-python@v4"
         with:
-          python-version: "3.8"
+          python-version: "3.11"
 
       - name: "Install python dependencies"
         run: |
diff --git a/template_config.yml b/template_config.yml
index fb2d81771..587c42634 100644
--- a/template_config.yml
+++ b/template_config.yml
@@ -1,7 +1,7 @@
 # This config represents the latest values used when running the plugin-template. Any settings that
 # were not present before running plugin-template have been added with their default values.
 
-# generated with plugin_template@2021.08.26-315-g8ecb63d
+# generated with plugin_template@2021.08.26-316-g69ef1f6
 
 api_root: /pulp/
 black: true
@@ -64,7 +64,6 @@ pulp_settings_gcp: null
 pulp_settings_s3: null
 pulpprojectdotorg_key_id: aa499d7938ed
 pydocstyle: true
-python_version: '3.8'
 release_email: pulp-infra@redhat.com
 release_user: pulpbot
 stalebot: true