diff --git a/.github/workflows/bump-elastic-stack-snapshot.yml b/.github/workflows/bump-elastic-stack-snapshot.yml
index f4a2842fa9d..835ead87a6a 100644
--- a/.github/workflows/bump-elastic-stack-snapshot.yml
+++ b/.github/workflows/bump-elastic-stack-snapshot.yml
@@ -9,9 +9,6 @@ on:
 permissions:
   contents: read
 
-env:
-  JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
 jobs:
   filter:
     runs-on: ubuntu-latest
@@ -29,14 +26,16 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJson(needs.filter.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: elastic/apm-pipeline-library/.github/actions/updatecli@current
         with:
           vaultUrl: ${{ secrets.VAULT_ADDR }}
           vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
           vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
-          pipeline: ./.ci/bump-elastic-stack-snapshot.yml
+          pipeline: .github/workflows/updatecli.d/bump-elastic-stack-snapshot.yml
+          values: .github/workflows/updatecli.d/scm.yml
+          command: '--experimental apply'
           notifySlackChannel: "#ingest-notifications"
           messageIfFailure: ":traffic_cone: updatecli failed for `${{ github.repository }}@${{ github.ref_name }}`, `@update-me-with-the-slack-team-to-be-poked` please look what's going on <${{ env.JOB_URL }}|here>"
         env:
diff --git a/.github/workflows/bump-golang.yml b/.github/workflows/bump-golang.yml
index 393c57f89a0..751b8612571 100644
--- a/.github/workflows/bump-golang.yml
+++ b/.github/workflows/bump-golang.yml
@@ -9,34 +9,35 @@ on:
 permissions:
   contents: read
 
-env:
-  JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
 jobs:
   bump-main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: elastic/apm-pipeline-library/.github/actions/updatecli@current
         with:
           vaultUrl: ${{ secrets.VAULT_ADDR }}
           vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
           vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
-          pipeline: ./.ci/bump-golang.yml
+          pipeline: .github/workflows/updatecli.d/bump-golang.yml
+          values: .github/workflows/updatecli.d/scm.yml
+          command: '--experimental apply'
           notifySlackChannel: "#ingest-notifications"
           messageIfFailure: ":traffic_cone: updatecli failed for `${{ github.repository }}@${{ github.ref_name }}`, `@update-me-with-the-slack-team-to-be-poked` please look what's going on <${{ env.JOB_URL }}|here>"
 
   bump-7-17:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: elastic/apm-pipeline-library/.github/actions/updatecli@current
         with:
           vaultUrl: ${{ secrets.VAULT_ADDR }}
           vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
           vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
-          pipeline: ./.ci/bump-golang-7.17.yml
+          pipeline: .github/workflows/updatecli.d/bump-golang-7.17.yml
+          values: .github/workflows/updatecli.d/scm.yml
+          command: '--experimental apply'
           notifySlackChannel: "#ingest-notifications"
           messageIfFailure: ":traffic_cone: updatecli failed for `${{ github.repository }}@${{ github.ref_name }}`, `@update-me-with-the-slack-team-to-be-poked` please look what's going on <${{ env.JOB_URL }}|here>"
diff --git a/.ci/bump-elastic-stack-snapshot.yml b/.github/workflows/updatecli.d/bump-elastic-stack-snapshot.yml
similarity index 80%
rename from .ci/bump-elastic-stack-snapshot.yml
rename to .github/workflows/updatecli.d/bump-elastic-stack-snapshot.yml
index f9060400c3f..f679e7924f3 100644
--- a/.ci/bump-elastic-stack-snapshot.yml
+++ b/.github/workflows/updatecli.d/bump-elastic-stack-snapshot.yml
@@ -6,6 +6,7 @@ actions:
   default:
     title: '[updatecli] update elastic stack version for testing {{ source "latestVersion" }}'
     kind: github/pullrequest
+    scmid: default
     spec:
       labels:
         - automation
@@ -13,21 +14,17 @@ actions:
         - backport-skip
         - build-monitoring
         - Team:Beats-On-Call
-      description: |
-        Generated automatically with {{ requiredEnv "JOB_URL" }}
-    scmid: default
 
 scms:
   default:
     kind: github
     spec:
-      user: '{{ requiredEnv "GIT_USER" }}'
-      email: '{{ requiredEnv "GIT_EMAIL" }}'
-      owner: elastic
-      repository: beats
+      owner: '{{ .scm.owner }}'
+      repository: '{{ .scm.repository }}'
+      user: '{{ requiredEnv "GITHUB_ACTOR" }}'
       token: '{{ requiredEnv "GITHUB_TOKEN" }}'
-      username: '{{ requiredEnv "GIT_USER" }}'
       branch: '{{ requiredEnv "BRANCH" }}'
+      commitusingapi: true
 
 sources:
   latestVersion:
diff --git a/.ci/bump-golang-7.17.yml b/.github/workflows/updatecli.d/bump-golang-7.17.yml
similarity index 96%
rename from .ci/bump-golang-7.17.yml
rename to .github/workflows/updatecli.d/bump-golang-7.17.yml
index 5b6619bc453..d6405aa1a8d 100644
--- a/.ci/bump-golang-7.17.yml
+++ b/.github/workflows/updatecli.d/bump-golang-7.17.yml
@@ -6,13 +6,12 @@ scms:
   githubConfig:
     kind: github
     spec:
-      user: '{{ requiredEnv "GIT_USER" }}'
-      email: '{{ requiredEnv "GIT_EMAIL" }}'
-      owner: elastic
-      repository: beats
+      owner: '{{ .scm.owner }}'
+      repository: '{{ .scm.repository }}'
+      user: '{{ requiredEnv "GITHUB_ACTOR" }}'
       token: '{{ requiredEnv "GITHUB_TOKEN" }}'
-      username: '{{ requiredEnv "GIT_USER" }}'
       branch: "7.17"
+      commitusingapi: true
 
 actions:
   beats:
@@ -21,12 +20,9 @@ actions:
     sourceid: latestGoVersion
     title: '[Automation][7.17] Bump Golang version to {{ source "latestGoVersion" }}'
     spec:
-      automerge: false
       labels:
         - dependencies
         - backport-skip
-      description: |
-        Generated automatically with {{ requiredEnv "JOB_URL" }}
 
 sources:
   minor:
diff --git a/.ci/bump-golang.yml b/.github/workflows/updatecli.d/bump-golang.yml
similarity index 95%
rename from .ci/bump-golang.yml
rename to .github/workflows/updatecli.d/bump-golang.yml
index 2957acd6223..9c30136f444 100644
--- a/.ci/bump-golang.yml
+++ b/.github/workflows/updatecli.d/bump-golang.yml
@@ -6,13 +6,12 @@ scms:
   githubConfig:
     kind: github
     spec:
-      user: '{{ requiredEnv "GIT_USER" }}'
-      email: '{{ requiredEnv "GIT_EMAIL" }}'
-      owner: elastic
-      repository: beats
+      owner: '{{ .scm.owner }}'
+      repository: '{{ .scm.repository }}'
+      user: '{{ requiredEnv "GITHUB_ACTOR" }}'
       token: '{{ requiredEnv "GITHUB_TOKEN" }}'
-      username: '{{ requiredEnv "GIT_USER" }}'
       branch: main
+      commitusingapi: true
 
 actions:
   beats:
@@ -21,12 +20,9 @@ actions:
     sourceid: latestGoVersion
     title: '[Automation] Bump Golang version to {{ source "latestGoVersion" }}'
     spec:
-      automerge: false
       labels:
         - dependencies
         - backport-skip
-      description: |
-        Generated automatically with {{ requiredEnv "JOB_URL" }}
 
 sources:
   minor:
diff --git a/.github/workflows/updatecli.d/scm.yml b/.github/workflows/updatecli.d/scm.yml
new file mode 100644
index 00000000000..fd532f00f61
--- /dev/null
+++ b/.github/workflows/updatecli.d/scm.yml
@@ -0,0 +1,4 @@
+---
+scm:
+  owner: elastic
+  repository: beats