diff --git a/integ/components/deadline/common/scripts/bastion/utils/configure-deadline.sh b/integ/components/deadline/common/scripts/bastion/utils/configure-deadline.sh
index bd6d02a1c..31016c68a 100644
--- a/integ/components/deadline/common/scripts/bastion/utils/configure-deadline.sh
+++ b/integ/components/deadline/common/scripts/bastion/utils/configure-deadline.sh
@@ -30,7 +30,13 @@ else
   # Non-TLS connections can connect to the repository directly
   sudo $DEADLINE/deadlinecommand SetIniFileSetting ProxyUseSSL False
   sudo $DEADLINE/deadlinecommand SetIniFileSetting ProxySSLCA ""
-  sudo $DEADLINE/deadlinecommand ChangeRepository Remote $ENDPOINT >/dev/null
+  ALL_USERS_OPTION=
+  if $DEADLINE/deadlinecommand --help | grep "^ChangeRepository " | grep -q "<Save For All Users>"; then
+    # Deadline 10.4 added an option to "Save For All Users".
+    # This is the default behavior in prior versions.
+    ALL_USERS_OPTION="True"
+  fi
+  sudo $DEADLINE/deadlinecommand ChangeRepository Remote $ENDPOINT '' '' $ALL_USERS_OPTION >/dev/null
 fi
 
 exit 0
diff --git a/integ/components/deadline/deadline_01_repository/bin/deadline_01_repository.ts b/integ/components/deadline/deadline_01_repository/bin/deadline_01_repository.ts
index c8e7240a0..71f25984c 100644
--- a/integ/components/deadline/deadline_01_repository/bin/deadline_01_repository.ts
+++ b/integ/components/deadline/deadline_01_repository/bin/deadline_01_repository.ts
@@ -5,7 +5,11 @@
 
 import { App, Stack, Aspects } from 'aws-cdk-lib';
 import { AutoScalingGroupRequireImdsv2Aspect } from 'aws-cdk-lib/aws-autoscaling';
-import { InstanceRequireImdsv2Aspect, LaunchTemplateRequireImdsv2Aspect } from 'aws-cdk-lib/aws-ec2';
+import {
+  InstanceRequireImdsv2Aspect,
+  LaunchTemplateRequireImdsv2Aspect,
+  MachineImage,
+} from 'aws-cdk-lib/aws-ec2';
 import {
   Stage,
   ThinkboxDockerRecipes,
@@ -49,7 +53,14 @@ const structs: Array<StorageStruct> = [
   }),
 ];
 
-new RepositoryTestingTier(app, 'RFDKInteg-DL-TestingTier' + integStackTag, { env, integStackTag, structs });
+new RepositoryTestingTier(app, 'RFDKInteg-DL-TestingTier' + integStackTag, {
+  env,
+  integStackTag,
+  structs,
+  // Currently we test using MongoDB 3.6, which doesn't run on the
+  // Amazon Linux 2023 image that we use to test Deadline 10.4.0.
+  bastionMachineImageOverride: MachineImage.latestAmazonLinux2(),
+});
 
 // Adds IAM Policy to Instance and ASG Roles
 Aspects.of(app).add(new SSMInstancePolicyAspect());
diff --git a/integ/components/deadline/deadline_03_workerFleetHttp/scripts/bastion/testing/WF-submit-jobs-to-sets.sh b/integ/components/deadline/deadline_03_workerFleetHttp/scripts/bastion/testing/WF-submit-jobs-to-sets.sh
index bb4aa438e..4579197f5 100644
--- a/integ/components/deadline/deadline_03_workerFleetHttp/scripts/bastion/testing/WF-submit-jobs-to-sets.sh
+++ b/integ/components/deadline/deadline_03_workerFleetHttp/scripts/bastion/testing/WF-submit-jobs-to-sets.sh
@@ -6,6 +6,7 @@
 # Script to submit test Deadline jobs to be picked up by worker nodes based on their assigned group or pool
 #
 # Input:
+#   WORKER_OS: The operating system that the Worker node is running on. Will be either "Linux" or "Windows".
 #   JOB_NAME: Name for the test config/job submitted to Deadline. Will be either "group" or "pool"
 #   ARG: Command line arg added to `deadlinecommand` to submit the job to only the specific group/pool for the test case
 # Output:
@@ -13,12 +14,26 @@
 
 set -euo pipefail
 
-JOB_NAME=$1
-ARG=$2
+WORKER_OS=$1
+JOB_NAME=$2
+ARG=$3
 DEADLINE="/opt/Thinkbox/Deadline10/bin"
 
+case ${WORKER_OS^^} in
+  LINUX)
+    JOB_EXECUTABLE="/usr/bin/sleep"
+    ;;
+  WINDOWS)
+    JOB_EXECUTABLE="timeout.exe"
+    ;;
+  *)
+    echo "Error: unknown WORKER_OS from command line arguments: ${WORKER_OS}"
+    exit 1
+    ;;
+esac
+
 # Send a sleep command to the render queue; based on the arg passed in, this job will be assigned to the test group or pool
-JOB_ID=$($DEADLINE/deadlinecommand --prettyjson SubmitCommandLineJob -executable "/usr/bin/sleep" -arguments "10" -frames "1-10" -name $JOB_NAME $ARG)
+JOB_ID=$($DEADLINE/deadlinecommand --prettyjson SubmitCommandLineJob -executable "$JOB_EXECUTABLE" -arguments "10" -frames "1-10" -name $JOB_NAME $ARG)
 # We then pull the jobId from the output of `SubmitCommandLineJob`
 JOB_ID=$(jq -r '.result' <<< "$JOB_ID")
 
diff --git a/integ/components/deadline/deadline_03_workerFleetHttp/test/deadline_03_workerFleetHttp.test.ts b/integ/components/deadline/deadline_03_workerFleetHttp/test/deadline_03_workerFleetHttp.test.ts
index 4e773430e..66aea2a1d 100644
--- a/integ/components/deadline/deadline_03_workerFleetHttp/test/deadline_03_workerFleetHttp.test.ts
+++ b/integ/components/deadline/deadline_03_workerFleetHttp/test/deadline_03_workerFleetHttp.test.ts
@@ -15,8 +15,8 @@ const bastionRegex = /bastionId/;
 const rqRegex = /renderQueueEndpointWF(\d)/;
 
 const testCases: Array<Array<any>> = [
-  [ 'Linux Worker HTTP mode', 1 ],
-  [ 'Windows Worker HTTP mode', 2 ],
+  [ 'Linux Worker HTTP mode', 1, 'Linux' ],
+  [ 'Windows Worker HTTP mode', 2, 'Windows' ],
 ];
 let bastionId: any;
 let renderQueueEndpoints: Array<string> = [];
@@ -45,7 +45,7 @@ beforeAll( async () => {
   });
 });
 
-describe.each(testCases)('Deadline WorkerFleet tests (%s)', (_, id) => {
+describe.each(testCases)('Deadline WorkerFleet tests (%s)', (_, id, workerOS) => {
   describe('Worker node tests', () => {
 
     // Before testing the render queue, send a command to configure the Deadline client to use that endpoint
@@ -139,7 +139,7 @@ describe.each(testCases)('Deadline WorkerFleet tests (%s)', (_, id) => {
             'sudo -i',
             'su - ec2-user >/dev/null',
             'cd ~ec2-user',
-            `./testScripts/WF-submit-jobs-to-sets.sh "${name}" "${arg}"`,
+            `./testScripts/WF-submit-jobs-to-sets.sh "${workerOS}" "${name}" "${arg}"`,
           ],
         },
       };
diff --git a/integ/components/deadline/deadline_04_workerFleetHttps/scripts/bastion/testing/WFS-submit-jobs-to-sets.sh b/integ/components/deadline/deadline_04_workerFleetHttps/scripts/bastion/testing/WFS-submit-jobs-to-sets.sh
index bb4aa438e..4579197f5 100644
--- a/integ/components/deadline/deadline_04_workerFleetHttps/scripts/bastion/testing/WFS-submit-jobs-to-sets.sh
+++ b/integ/components/deadline/deadline_04_workerFleetHttps/scripts/bastion/testing/WFS-submit-jobs-to-sets.sh
@@ -6,6 +6,7 @@
 # Script to submit test Deadline jobs to be picked up by worker nodes based on their assigned group or pool
 #
 # Input:
+#   WORKER_OS: The operating system that the Worker node is running on. Will be either "Linux" or "Windows".
 #   JOB_NAME: Name for the test config/job submitted to Deadline. Will be either "group" or "pool"
 #   ARG: Command line arg added to `deadlinecommand` to submit the job to only the specific group/pool for the test case
 # Output:
@@ -13,12 +14,26 @@
 
 set -euo pipefail
 
-JOB_NAME=$1
-ARG=$2
+WORKER_OS=$1
+JOB_NAME=$2
+ARG=$3
 DEADLINE="/opt/Thinkbox/Deadline10/bin"
 
+case ${WORKER_OS^^} in
+  LINUX)
+    JOB_EXECUTABLE="/usr/bin/sleep"
+    ;;
+  WINDOWS)
+    JOB_EXECUTABLE="timeout.exe"
+    ;;
+  *)
+    echo "Error: unknown WORKER_OS from command line arguments: ${WORKER_OS}"
+    exit 1
+    ;;
+esac
+
 # Send a sleep command to the render queue; based on the arg passed in, this job will be assigned to the test group or pool
-JOB_ID=$($DEADLINE/deadlinecommand --prettyjson SubmitCommandLineJob -executable "/usr/bin/sleep" -arguments "10" -frames "1-10" -name $JOB_NAME $ARG)
+JOB_ID=$($DEADLINE/deadlinecommand --prettyjson SubmitCommandLineJob -executable "$JOB_EXECUTABLE" -arguments "10" -frames "1-10" -name $JOB_NAME $ARG)
 # We then pull the jobId from the output of `SubmitCommandLineJob`
 JOB_ID=$(jq -r '.result' <<< "$JOB_ID")
 
diff --git a/integ/components/deadline/deadline_04_workerFleetHttps/test/deadline_04_workerFleetHttps.test.ts b/integ/components/deadline/deadline_04_workerFleetHttps/test/deadline_04_workerFleetHttps.test.ts
index d4132da61..826ad3e05 100644
--- a/integ/components/deadline/deadline_04_workerFleetHttps/test/deadline_04_workerFleetHttps.test.ts
+++ b/integ/components/deadline/deadline_04_workerFleetHttps/test/deadline_04_workerFleetHttps.test.ts
@@ -19,8 +19,8 @@ const rqRegex = /renderQueueEndpointWFS(\d)/;
 const certRegex = /CertSecretARNWFS(\d)/;
 
 const testCases: Array<Array<any>> = [
-  [ 'Linux Worker HTTPS (TLS) mode', 1 ],
-  [ 'Windows Worker HTTPS (TLS) mode', 2 ],
+  [ 'Linux Worker HTTPS (TLS) mode', 1, 'Linux' ],
+  [ 'Windows Worker HTTPS (TLS) mode', 2, 'Windows' ],
 ];
 let bastionId: any;
 let renderQueueEndpoints: Array<string> = [];
@@ -54,7 +54,7 @@ beforeAll( async () => {
   });
 });
 
-describe.each(testCases)('Deadline WorkerFleetHttps tests (%s)', (_, id) => {
+describe.each(testCases)('Deadline WorkerFleetHttps tests (%s)', (_, id, workerOS) => {
 
   beforeAll( async () => {
     if(secretARNs[id]) {
@@ -191,7 +191,7 @@ describe.each(testCases)('Deadline WorkerFleetHttps tests (%s)', (_, id) => {
             'sudo -i',
             'su - ec2-user >/dev/null',
             'cd ~ec2-user',
-            `./testScripts/WFS-submit-jobs-to-sets.sh "${name}" "${arg}"`,
+            `./testScripts/WFS-submit-jobs-to-sets.sh "${workerOS}" "${name}" "${arg}"`,
           ],
         },
       };
diff --git a/integ/lib/testing-tier.ts b/integ/lib/testing-tier.ts
index ef287e41d..f82502948 100644
--- a/integ/lib/testing-tier.ts
+++ b/integ/lib/testing-tier.ts
@@ -7,7 +7,9 @@ import * as path from 'path';
 import { CfnOutput, Duration, Stack, StackProps } from 'aws-cdk-lib';
 import {
   BastionHostLinux,
+  IMachineImage,
   InstanceType,
+  MachineImage,
   Port,
   Vpc,
 } from 'aws-cdk-lib/aws-ec2';
@@ -16,7 +18,7 @@ import {
   SessionManagerHelper,
   X509CertificatePem,
 } from 'aws-rfdk';
-import { RenderQueue } from 'aws-rfdk/deadline';
+import { RenderQueue, Version } from 'aws-rfdk/deadline';
 import { Construct } from 'constructs';
 import { NetworkTier } from '../components/_infrastructure/lib/network-tier';
 import { IRenderFarmDb } from './storage-struct';
@@ -39,6 +41,12 @@ export interface TestingTierProps extends StackProps {
    * The unique suffix given to all stacks in the testing app
    */
   readonly integStackTag: string;
+
+  /**
+   * The machine image to use for the Bastion instance.
+   * Defaults to an image that's suitable for running Deadline.
+   */
+  readonly bastionMachineImageOverride?: IMachineImage;
 }
 
 /**
@@ -79,6 +87,7 @@ export abstract class TestingTier extends Stack {
       vpc: this.vpc,
       subnetSelection: { subnetGroupName: NetworkTier.subnetConfig.testRunner.name },
       instanceType: new InstanceType('t3.small'),
+      machineImage: props.bastionMachineImageOverride ?? this.getMachineImageForDeadlineVersion(this.deadlineVersion),
     });
     if (process.env.DEV_MODE?.toLowerCase() === 'true') {
       SessionManagerHelper.grantPermissionsTo(this.testInstance);
@@ -88,7 +97,6 @@ export abstract class TestingTier extends Stack {
     new CfnOutput(this, 'bastionId', {
       value: this.testInstance.instanceId,
     });
-
   }
 
   /**
@@ -179,7 +187,6 @@ export abstract class TestingTier extends Stack {
       'cd ~ec2-user',
       `cp ${installerPath} ./deadline-client-installer.run`,
       'chmod +x *.run',
-      'sudo yum install -y lsb',
       'sudo ./deadline-client-installer.run --mode unattended',
       `rm -f ${installerPath}`,
       'rm -f ./deadline-client-installer.run',
@@ -274,4 +281,17 @@ export abstract class TestingTier extends Stack {
     this.testInstance.instance.userData.addCommands( ...userDataCommands );
     this.testInstance.instance.userData.addSignalOnExitCommand( this.testInstance.instance );
   }
+
+  /**
+   * Return an Amazon Linux machine image that can run the specified version of Deadline.
+   */
+  private getMachineImageForDeadlineVersion(deadlineVersion: string): IMachineImage {
+    const REMOVED_SUPPORT_FOR_AMAZON_LINUX_2 = new Version([10, 4, 0, 0]);
+
+    if (Version.parse(deadlineVersion).isLessThan(REMOVED_SUPPORT_FOR_AMAZON_LINUX_2)) {
+      return MachineImage.latestAmazonLinux2();
+    } else {
+      return MachineImage.latestAmazonLinux2023();
+    }
+  }
 }
diff --git a/integ/test-config.sh b/integ/test-config.sh
index 3eb90f479..16775bca6 100755
--- a/integ/test-config.sh
+++ b/integ/test-config.sh
@@ -54,6 +54,7 @@ export LINUX_DEADLINE_AMI_ID
 export WINDOWS_DEADLINE_AMI_ID
 
 # Configure test suites to include in end-to-end test
+#   - To skip a test, set it to true
 export SKIP_deadline_01_repository_TEST
 export SKIP_deadline_02_renderQueue_TEST
 export SKIP_deadline_03_workerFleetHttp_TEST
diff --git a/packages/aws-rfdk/lib/core/lib/deployment-instance.ts b/packages/aws-rfdk/lib/core/lib/deployment-instance.ts
index c01d0b762..390fda976 100644
--- a/packages/aws-rfdk/lib/core/lib/deployment-instance.ts
+++ b/packages/aws-rfdk/lib/core/lib/deployment-instance.ts
@@ -172,7 +172,7 @@ export class DeploymentInstance extends Construct implements IScriptHost, IConne
     this.asg = new AutoScalingGroup(this, 'ASG', {
       instanceType: props.instanceType ?? InstanceType.of(InstanceClass.T3, InstanceSize.SMALL),
       keyName: props.keyName,
-      machineImage: props.machineImage ?? MachineImage.latestAmazonLinux2(),
+      machineImage: props.machineImage ?? MachineImage.latestAmazonLinux2023(),
       minCapacity: 1,
       maxCapacity: 1,
       securityGroup: props.securityGroup,
diff --git a/packages/aws-rfdk/lib/core/lib/mongodb-instance.ts b/packages/aws-rfdk/lib/core/lib/mongodb-instance.ts
index 1187a9aba..03d19a366 100644
--- a/packages/aws-rfdk/lib/core/lib/mongodb-instance.ts
+++ b/packages/aws-rfdk/lib/core/lib/mongodb-instance.ts
@@ -585,6 +585,8 @@ export class MongoDbInstance extends Construct implements IMongoDb, IGrantable {
       'sudo chmod 750 /etc/mongod_certs/', // Directory needs to be executable.
       // mongod user id might, potentially change on reboot. Make sure we own all mongo data
       `sudo chown mongod.mongod -R ${MongoDbInstance.MONGO_DEVICE_MOUNT_POINT}`,
+      // We need yaml for some of our MongoDB configuration scripts
+      'sudo yum install -y python3-PyYAML',
       // Configure mongod
       'bash ./setMongoLimits.sh',
       `bash ./setStoragePath.sh "${MongoDbInstance.MONGO_DEVICE_MOUNT_POINT}"`,
diff --git a/packages/aws-rfdk/lib/core/scripts/bash/configureCloudWatchAgent.sh b/packages/aws-rfdk/lib/core/scripts/bash/configureCloudWatchAgent.sh
index d9ef82c4d..7c36e6fd5 100644
--- a/packages/aws-rfdk/lib/core/scripts/bash/configureCloudWatchAgent.sh
+++ b/packages/aws-rfdk/lib/core/scripts/bash/configureCloudWatchAgent.sh
@@ -31,17 +31,25 @@ function install_agent {
   TMPDIR=$(mktemp -d)
   pushd $TMPDIR 2>&1 > /dev/null
 
+  # Set the gpg home directory, where it stores configuration files.
+  # By default, this is in the user's home directory. This might not exist, causing errors.
+  # We don't need these files after installation, so we use a temporary directory.
+  export GNUPGHOME=${TMPDIR}
+
   # Download CloudWatch agent installer
   aws s3api get-object --region $region --bucket amazoncloudwatch-agent-$region --key amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm amazon-cloudwatch-agent.rpm
 
   if [ "$SKIP_VERIFICATION" = false ]
   then
     aws s3api get-object --region $region --bucket amazoncloudwatch-agent-$region --key assets/amazon-cloudwatch-agent.gpg amazon-cloudwatch-agent.gpg
-    GPG_IMPORT_OUT=$(gpg --no-default-keyring --keyring ./keyring.gpg --import amazon-cloudwatch-agent.gpg 2>&1)
+    GPG_IMPORT_OUT=$(gpg --no-default-keyring --keyring ${TMPDIR}/keyring.gpg --import amazon-cloudwatch-agent.gpg 2>&1)
     GPG_KEY=$(echo "${GPG_IMPORT_OUT}" | grep -Eow 'key [0-9A-F]+' | awk '{print $2}')
-    GPG_FINGERPRINT_OUT=$(gpg --no-default-keyring --keyring ./keyring.gpg --fingerprint ${GPG_KEY} 2>&1)
-    GPG_FINGERPRINT=$(echo "${GPG_FINGERPRINT_OUT}" | tr -d '[:blank:]' | grep -Eo 'fingerprint=[0-9A-F]{40}')
-    if test "${GPG_FINGERPRINT}" != "fingerprint=937616F3450B7D806CBD9725D58167303B789C72"
+    GPG_FINGERPRINT_OUT=$(gpg --no-default-keyring --keyring ${TMPDIR}/keyring.gpg --fingerprint --with-colons ${GPG_KEY} 2>&1)
+    # The "--with-colons" above requests output in a machine-readable colon separated format.
+    # For a description of the format, see https://github.com/gpg/gnupg/blob/master/doc/DETAILS
+    # We're looking for the "fpr" or "Fingerprint" record, which has the fingerprint in field 10.
+    GPG_FINGERPRINT=$(echo "${GPG_FINGERPRINT_OUT}" | grep '^fpr:' | cut -d ':' -f10)
+    if test "${GPG_FINGERPRINT}" != "937616F3450B7D806CBD9725D58167303B789C72"
     then
         # Key failed to verify. Alert AWS!!
         echo "ERROR: Key failed to verify."
@@ -51,7 +59,7 @@ function install_agent {
     fi
 
     aws s3api get-object --region $region --bucket amazoncloudwatch-agent-$region --key amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig amazon-cloudwatch-agent.rpm.sig
-    if ! gpg --no-default-keyring --keyring ./keyring.gpg --verify amazon-cloudwatch-agent.rpm.sig amazon-cloudwatch-agent.rpm 2>&1
+    if ! gpg --no-default-keyring --keyring ${TMPDIR}/keyring.gpg --verify amazon-cloudwatch-agent.rpm.sig amazon-cloudwatch-agent.rpm 2>&1
     then
         # CloudWatch agent installer failed to verify. Alert AWS!!
         echo "ERROR: Agent installer failed to verify"
diff --git a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/secretsFunction.sh b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/secretsFunction.sh
index bcf4c48ef..0b743a42c 100644
--- a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/secretsFunction.sh
+++ b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/secretsFunction.sh
@@ -6,8 +6,8 @@
 function get_secret_string() {
   SECRET_ID=$1
   AWS_REGION=$(echo ${SECRET_ID} | cut -d: -f4)
-  PYTHON_SCRIPT="import json,sys; d=json.load(sys.stdin); print d[\"SecretString\"];"
+  PYTHON_SCRIPT="import json,sys; d=json.load(sys.stdin); print(d[\"SecretString\"]);"
   set +x
-  export RET_VALUE=$(aws --region ${AWS_REGION} secretsmanager get-secret-value --secret-id "${SECRET_ID}" | python -c "${PYTHON_SCRIPT}" )
+  export RET_VALUE=$(aws --region ${AWS_REGION} secretsmanager get-secret-value --secret-id "${SECRET_ID}" | python3 -c "${PYTHON_SCRIPT}" )
   set -x
 }
diff --git a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setLiveConfiguration.sh b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setLiveConfiguration.sh
index 0d0041c6d..84accdcc5 100644
--- a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setLiveConfiguration.sh
+++ b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setLiveConfiguration.sh
@@ -8,7 +8,7 @@
 
 set -xeufo pipefail
 
-cat /etc/mongod.conf | python ./setupMongodLiveConfig.py > ./mongod.conf.new
+cat /etc/mongod.conf | python3 ./setupMongodLiveConfig.py > ./mongod.conf.new
 sudo mv ./mongod.conf.new /etc/mongod.conf
 # Make sure mongod user can read the config file
 sudo chmod 640 /etc/mongod.conf
diff --git a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setMongoNoAuth.sh b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setMongoNoAuth.sh
index 45f78deee..b3d1ee5c9 100644
--- a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setMongoNoAuth.sh
+++ b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setMongoNoAuth.sh
@@ -3,7 +3,7 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-cat /etc/mongod.conf | python ./setupMongodNoAuth.py > ./mongod.conf.new
+cat /etc/mongod.conf | python3 ./setupMongodNoAuth.py > ./mongod.conf.new
 sudo mv ./mongod.conf.new /etc/mongod.conf
 # Make sure mongod user can read the config file
 sudo chmod 640 /etc/mongod.conf
diff --git a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setStoragePath.sh b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setStoragePath.sh
index 811014032..31c3753cc 100644
--- a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setStoragePath.sh
+++ b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setStoragePath.sh
@@ -16,7 +16,7 @@ fi
 
 STORAGE_PATH=$1
 
-cat /etc/mongod.conf | python ./setupMongodStorage.py "${STORAGE_PATH}" > ./mongod.conf.new
+cat /etc/mongod.conf | python3 ./setupMongodStorage.py "${STORAGE_PATH}" > ./mongod.conf.new
 sudo mv ./mongod.conf.new /etc/mongod.conf
 # Make sure mongod user can read the config file
 sudo chmod 640 /etc/mongod.conf
diff --git a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodLiveConfig.py b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodLiveConfig.py
index 98cb6fd09..ef6656899 100644
--- a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodLiveConfig.py
+++ b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodLiveConfig.py
@@ -1,4 +1,4 @@
-#!/bin/env python
+#!/bin/env python3
 
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
@@ -98,7 +98,7 @@ def main():
   mongod_conf = yaml.load(sys.stdin)
   modify_security(mongod_conf)
   modify_net_options(mongod_conf)
-  print yaml.dump(mongod_conf, default_flow_style=False)
+  print(yaml.dump(mongod_conf, default_flow_style=False))
 
 if __name__ == '__main__':
   main()
\ No newline at end of file
diff --git a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodNoAuth.py b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodNoAuth.py
index 0d9e33006..e0766b64d 100644
--- a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodNoAuth.py
+++ b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodNoAuth.py
@@ -1,4 +1,4 @@
-#!/bin/env python
+#!/bin/env python3
 
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
@@ -81,7 +81,7 @@ def main():
   mongod_conf = yaml.load(sys.stdin)
   modify_security(mongod_conf)
   modify_network(mongod_conf)
-  print yaml.dump(mongod_conf, default_flow_style=False)
+  print(yaml.dump(mongod_conf, default_flow_style=False))
 
 if __name__ == '__main__':
   main()
\ No newline at end of file
diff --git a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodStorage.py b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodStorage.py
index 803a4e562..a4e507acd 100644
--- a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodStorage.py
+++ b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/setupMongodStorage.py
@@ -1,4 +1,4 @@
-#!/bin/env python
+#!/bin/env python3
 
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
diff --git a/packages/aws-rfdk/lib/core/test/asset-constants.ts b/packages/aws-rfdk/lib/core/test/asset-constants.ts
index 5a5127398..d32fd8d57 100644
--- a/packages/aws-rfdk/lib/core/test/asset-constants.ts
+++ b/packages/aws-rfdk/lib/core/test/asset-constants.ts
@@ -6,7 +6,7 @@
 // ConfigureCloudWatchAgent.sh
 export const CWA_ASSET_LINUX = {
   Bucket: 'cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}',
-  Key: 'f3261b0f6923b012a8fce5cd6984211bc48b9977844b3fa44229234dc6f21d43',
+  Key: 'a1eed7232f6afcc474e870e7c3c01b7f4aec028de3a20eccc76ad9050032eecb',
 };
 
 // ConfigureCloudWatchAgent.ps1
@@ -38,5 +38,5 @@ export const INSTALL_MONGODB_3_6_SCRIPT_LINUX = {
 
 export const MONGODB_3_6_CONFIGURATION_SCRIPTS = {
   Bucket: 'cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}',
-  Key: '433ead41839a7d4dad68bf0149f907050caa6d95bb7b5b180e5ff21a5dad3c19',
+  Key: '3b571d3659f9f47af6005ca9619c6aec2a576cea5a53b8707544df0a80e368c8',
 };
diff --git a/packages/aws-rfdk/lib/core/test/cloudwatch-agent.test.ts b/packages/aws-rfdk/lib/core/test/cloudwatch-agent.test.ts
index 4c2764815..93b87b057 100644
--- a/packages/aws-rfdk/lib/core/test/cloudwatch-agent.test.ts
+++ b/packages/aws-rfdk/lib/core/test/cloudwatch-agent.test.ts
@@ -46,7 +46,7 @@ describe('CloudWatchAgent', () => {
     const host = new Instance(stack, 'Instance', {
       instanceType: InstanceType.of(InstanceClass.T2, InstanceSize.LARGE),
       machineImage: new AmazonLinuxImage({
-        generation: AmazonLinuxGeneration.AMAZON_LINUX_2,
+        generation: AmazonLinuxGeneration.AMAZON_LINUX_2023,
       }),
       vpc,
     });
@@ -69,7 +69,7 @@ describe('CloudWatchAgent', () => {
     const host = new Instance(stack, 'Instance', {
       instanceType: InstanceType.of(InstanceClass.T2, InstanceSize.LARGE),
       machineImage: new AmazonLinuxImage({
-        generation: AmazonLinuxGeneration.AMAZON_LINUX_2,
+        generation: AmazonLinuxGeneration.AMAZON_LINUX_2023,
       }),
       vpc,
     });
@@ -216,7 +216,7 @@ describe('CloudWatchAgent', () => {
     const host = new Instance(stack, 'Instance', {
       instanceType: InstanceType.of(InstanceClass.T2, InstanceSize.LARGE),
       machineImage: new AmazonLinuxImage({
-        generation: AmazonLinuxGeneration.AMAZON_LINUX_2,
+        generation: AmazonLinuxGeneration.AMAZON_LINUX_2023,
       }),
       vpc,
     });
diff --git a/packages/aws-rfdk/lib/core/test/deployment-instance.test.ts b/packages/aws-rfdk/lib/core/test/deployment-instance.test.ts
index 47c3be06a..cdb31fdce 100644
--- a/packages/aws-rfdk/lib/core/test/deployment-instance.test.ts
+++ b/packages/aws-rfdk/lib/core/test/deployment-instance.test.ts
@@ -158,7 +158,7 @@ describe('DeploymentInstance', () => {
 
       test('uses latest Amazon Linux machine image', () => {
         // GIVEN
-        const amazonLinux = MachineImage.latestAmazonLinux2();
+        const amazonLinux = MachineImage.latestAmazonLinux2023();
         const imageId: { Ref: string } = stack.resolve(amazonLinux.getImage(stack)).imageId;
 
         // THEN
diff --git a/packages/aws-rfdk/lib/core/test/health-monitor.test.ts b/packages/aws-rfdk/lib/core/test/health-monitor.test.ts
index 880090376..5f3633c12 100644
--- a/packages/aws-rfdk/lib/core/test/health-monitor.test.ts
+++ b/packages/aws-rfdk/lib/core/test/health-monitor.test.ts
@@ -79,7 +79,7 @@ class TestMonitorableFleet extends Construct implements IMonitorableFleet {
     const fleet = new AutoScalingGroup(this, 'ASG', {
       instanceType: InstanceType.of(InstanceClass.T2, InstanceSize.LARGE),
       machineImage: new AmazonLinuxImage({
-        generation: AmazonLinuxGeneration.AMAZON_LINUX_2,
+        generation: AmazonLinuxGeneration.AMAZON_LINUX_2023,
       }),
       vpc: props.vpc,
       minCapacity: props.minCapacity,
diff --git a/packages/aws-rfdk/lib/core/test/mongodb-installer.test.ts b/packages/aws-rfdk/lib/core/test/mongodb-installer.test.ts
index 551de152d..113158f29 100644
--- a/packages/aws-rfdk/lib/core/test/mongodb-installer.test.ts
+++ b/packages/aws-rfdk/lib/core/test/mongodb-installer.test.ts
@@ -72,7 +72,7 @@ Please set the userSsplAcceptance property to USER_ACCEPTS_SSPL to signify your
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
     const installer = new MongoDbInstaller(stack, {
       version: MongoDbVersion.COMMUNITY_3_6,
@@ -172,7 +172,7 @@ Please set the userSsplAcceptance property to USER_ACCEPTS_SSPL to signify your
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
     const installer1 = new MongoDbInstaller(stack, {
       version: MongoDbVersion.COMMUNITY_3_6,
diff --git a/packages/aws-rfdk/lib/core/test/mongodb-instance.test.ts b/packages/aws-rfdk/lib/core/test/mongodb-instance.test.ts
index 3694655f2..134334c75 100644
--- a/packages/aws-rfdk/lib/core/test/mongodb-instance.test.ts
+++ b/packages/aws-rfdk/lib/core/test/mongodb-instance.test.ts
@@ -454,6 +454,7 @@ describe('Test MongoDbInstance', () => {
               'sudo chmod 640 -R /etc/mongod_certs/\n' +
               'sudo chmod 750 /etc/mongod_certs/\n' +
               'sudo chown mongod.mongod -R /var/lib/mongo\n' +
+              'sudo yum install -y python3-PyYAML\n' +
               'bash ./setMongoLimits.sh\n' +
               'bash ./setStoragePath.sh "/var/lib/mongo"\n' +
               'bash ./setMongoNoAuth.sh\n' +
diff --git a/packages/aws-rfdk/lib/core/test/mountable-ebs.test.ts b/packages/aws-rfdk/lib/core/test/mountable-ebs.test.ts
index d388fabb9..118090c9d 100644
--- a/packages/aws-rfdk/lib/core/test/mountable-ebs.test.ts
+++ b/packages/aws-rfdk/lib/core/test/mountable-ebs.test.ts
@@ -50,7 +50,7 @@ describe('Test MountableBlockVolume', () => {
     instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
   });
 
diff --git a/packages/aws-rfdk/lib/core/test/mountable-efs.test.ts b/packages/aws-rfdk/lib/core/test/mountable-efs.test.ts
index 0f11cffa0..511674059 100644
--- a/packages/aws-rfdk/lib/core/test/mountable-efs.test.ts
+++ b/packages/aws-rfdk/lib/core/test/mountable-efs.test.ts
@@ -52,7 +52,7 @@ describe('Test MountableEFS', () => {
     instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
   });
 
diff --git a/packages/aws-rfdk/lib/core/test/mountable-fsx-lustre.test.ts b/packages/aws-rfdk/lib/core/test/mountable-fsx-lustre.test.ts
index e458f8aad..289a5b270 100644
--- a/packages/aws-rfdk/lib/core/test/mountable-fsx-lustre.test.ts
+++ b/packages/aws-rfdk/lib/core/test/mountable-fsx-lustre.test.ts
@@ -63,7 +63,7 @@ describe('MountableFsxLustre', () => {
     instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
       securityGroup: instanceSecurityGroup,
     });
   });
diff --git a/packages/aws-rfdk/lib/core/test/staticip-server.test.ts b/packages/aws-rfdk/lib/core/test/staticip-server.test.ts
index c2f6e2c0c..c8d8d9364 100644
--- a/packages/aws-rfdk/lib/core/test/staticip-server.test.ts
+++ b/packages/aws-rfdk/lib/core/test/staticip-server.test.ts
@@ -36,7 +36,7 @@ describe('Test StaticIpServer', () => {
     new StaticPrivateIpServer(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // THEN
@@ -196,12 +196,12 @@ describe('Test StaticIpServer', () => {
     new StaticPrivateIpServer(stack, 'Instance1', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
     new StaticPrivateIpServer(stack, 'Instance2', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // THEN
@@ -238,7 +238,7 @@ describe('Test StaticIpServer', () => {
       new StaticPrivateIpServer(stack, 'Instance', {
         vpc,
         instanceType: new InstanceType('t3.small'),
-        machineImage: MachineImage.latestAmazonLinux2(),
+        machineImage: MachineImage.latestAmazonLinux2023(),
         vpcSubnets: {
           subnetType: SubnetType.PRIVATE_WITH_EGRESS,
           availabilityZones: ['dummy zone'],
@@ -252,7 +252,7 @@ describe('Test StaticIpServer', () => {
     new StaticPrivateIpServer(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
       resourceSignalTimeout: Duration.hours(12),
     });
 
@@ -269,7 +269,7 @@ describe('Test StaticIpServer', () => {
       new StaticPrivateIpServer(stack, 'InstanceFail', {
         vpc,
         instanceType: new InstanceType('t3.small'),
-        machineImage: MachineImage.latestAmazonLinux2(),
+        machineImage: MachineImage.latestAmazonLinux2023(),
         resourceSignalTimeout: Duration.seconds(12 * 60 * 60 + 1),
       });
     }).toThrow('Resource signal timeout cannot exceed 12 hours.');
diff --git a/packages/aws-rfdk/lib/deadline/lib/database-connection.ts b/packages/aws-rfdk/lib/deadline/lib/database-connection.ts
index 91ac017e9..9c61e904f 100644
--- a/packages/aws-rfdk/lib/deadline/lib/database-connection.ts
+++ b/packages/aws-rfdk/lib/deadline/lib/database-connection.ts
@@ -210,7 +210,7 @@ class DocDBDatabaseConnection extends DatabaseConnection {
     }
     host.userData.addCommands(
       'configure_database_installation_args(){',
-      'getJsonVal(){ python -c \'import json,sys;obj=json.load(sys.stdin);print obj["\'$1\'"]\'; }',
+      'getJsonVal(){ python3 -c \'import json,sys;obj=json.load(sys.stdin);print(obj["\'$1\'"])\'; }',
       'SET_X_IS_SET=$-',
       '{ set +x; } 2>/dev/null',
       `export SECRET_STRING=\`aws secretsmanager get-secret-value --secret-id ${this.props.login.secretArn} --region ${Stack.of(this.props.login).region} | getJsonVal 'SecretString'\``,
@@ -236,7 +236,7 @@ class DocDBDatabaseConnection extends DatabaseConnection {
     }
     host.userData.addCommands(
       'configure_deadline_database(){',
-      'getJsonVal(){ python -c \'import json,sys;obj=json.load(sys.stdin);print obj["\'$1\'"]\'; }',
+      'getJsonVal(){ python3 -c \'import json,sys;obj=json.load(sys.stdin);print(obj["\'$1\'"])\'; }',
       'SET_X_IS_SET=$-',
       '{ set +x; } 2>/dev/null',
       `export SECRET_STRING=\`aws secretsmanager get-secret-value --secret-id ${this.props.login.secretArn} --region ${Stack.of(this.props.login).region} | getJsonVal 'SecretString'\``,
@@ -390,7 +390,7 @@ class MongoDbInstanceDatabaseConnection extends DatabaseConnection {
     const certPwSecret = this.props.clientCertificate.passphrase;
     host.userData.addCommands(
       'configure_database_installation_args(){',
-      'getJsonVal(){ python -c \'import json,sys;obj=json.load(sys.stdin);print obj["\'$1\'"]\'; }',
+      'getJsonVal(){ python3 -c \'import json,sys;obj=json.load(sys.stdin);print(obj["\'$1\'"])\'; }',
       // Suppress -x, so no secrets go to the logs
       'SET_X_IS_SET=$-',
       '{ set +x; } 2>/dev/null',
@@ -417,7 +417,7 @@ class MongoDbInstanceDatabaseConnection extends DatabaseConnection {
     const certPwSecret = this.props.clientCertificate.passphrase;
     host.userData.addCommands(
       'configure_deadline_database(){',
-      'getJsonVal(){ python -c \'import json,sys;obj=json.load(sys.stdin);print obj["\'$1\'"]\'; }',
+      'getJsonVal(){ python3 -c \'import json,sys;obj=json.load(sys.stdin);print(obj["\'$1\'"])\'; }',
       'SET_X_IS_SET=$-',
       '{ set +x; } 2>/dev/null',
       `export DB_CERT_FILE="${MongoDbInstanceDatabaseConnection.DB_CERT_LOCATION}"`,
diff --git a/packages/aws-rfdk/lib/deadline/lib/render-queue.ts b/packages/aws-rfdk/lib/deadline/lib/render-queue.ts
index f504d733b..f9d7c79f0 100644
--- a/packages/aws-rfdk/lib/deadline/lib/render-queue.ts
+++ b/packages/aws-rfdk/lib/deadline/lib/render-queue.ts
@@ -31,6 +31,7 @@ import {
   Cluster,
   ContainerImage,
   Ec2TaskDefinition,
+  EcsOptimizedImage,
   LogDriver,
   PlacementConstraint,
   Scope,
@@ -452,6 +453,7 @@ export class RenderQueue extends RenderQueueBase implements IGrantable {
       // so this security group will get applied there
       // @ts-ignore
       securityGroup: props.securityGroups?.backend,
+      machineImage: EcsOptimizedImage.amazonLinux2023(),
     });
 
     this.backendConnections = this.asg.connections;
diff --git a/packages/aws-rfdk/lib/deadline/lib/repository.ts b/packages/aws-rfdk/lib/deadline/lib/repository.ts
index 2352b9b5b..14337a99f 100644
--- a/packages/aws-rfdk/lib/deadline/lib/repository.ts
+++ b/packages/aws-rfdk/lib/deadline/lib/repository.ts
@@ -732,7 +732,7 @@ export class Repository extends Construct implements IRepository {
     this.installerGroup = new AutoScalingGroup(this, 'Installer', {
       instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.LARGE),
       machineImage: new AmazonLinuxImage({
-        generation: AmazonLinuxGeneration.AMAZON_LINUX_2,
+        generation: AmazonLinuxGeneration.AMAZON_LINUX_2023,
       }),
       vpc: props.vpc,
       vpcSubnets: props.vpcSubnets ?? {
diff --git a/packages/aws-rfdk/lib/deadline/lib/usage-based-licensing.ts b/packages/aws-rfdk/lib/deadline/lib/usage-based-licensing.ts
index 69a6631a8..9f4485124 100644
--- a/packages/aws-rfdk/lib/deadline/lib/usage-based-licensing.ts
+++ b/packages/aws-rfdk/lib/deadline/lib/usage-based-licensing.ts
@@ -27,6 +27,7 @@ import {
   Compatibility,
   ContainerImage,
   Ec2Service,
+  EcsOptimizedImage,
   LogDriver,
   NetworkMode,
   PlacementConstraint,
@@ -541,6 +542,7 @@ export class UsageBasedLicensing extends Construct implements IGrantable {
       // so this security group will get applied there
       // @ts-ignore
       securityGroup: props.securityGroup,
+      machineImage: EcsOptimizedImage.amazonLinux2023(),
     });
 
     const taskDefinition = new TaskDefinition(this, 'TaskDefinition', {
diff --git a/packages/aws-rfdk/lib/deadline/scripts/bash/configureWorker.sh b/packages/aws-rfdk/lib/deadline/scripts/bash/configureWorker.sh
index 713fb5345..a080dfbc2 100644
--- a/packages/aws-rfdk/lib/deadline/scripts/bash/configureWorker.sh
+++ b/packages/aws-rfdk/lib/deadline/scripts/bash/configureWorker.sh
@@ -41,7 +41,7 @@ if [ ! -f "$DEADLINE_COMMAND" ]; then
 fi
 
 isVersionLessThan() {
-    python -c "import sys;sys.exit(0 if tuple(map(int, sys.argv[-2].split('.'))) < tuple(map(int, sys.argv[-1].split('.'))) else 1)" "$1" "$2"
+    python3 -c "import sys;sys.exit(0 if tuple(map(int, sys.argv[-2].split('.'))) < tuple(map(int, sys.argv[-1].split('.'))) else 1)" "$1" "$2"
 }
 
 DEADLINE_VERSION=$("$DEADLINE_COMMAND" -Version | grep -oP '[v]\K\d+\.\d+\.\d+\.\d+\b')
@@ -125,7 +125,16 @@ for worker_name in "${WORKER_NAMES[@]}"; do
 done
 
 # Restart service, if it exists, else restart application
+has_launcher_service=false
 if service --status-all | grep -q 'Deadline 10 Launcher'; then
+  has_launcher_service=true
+elif command -v systemctl; then
+  if systemctl list-unit-files deadline10launcher.service; then
+    has_launcher_service=true
+  fi
+fi
+
+if [ "$has_launcher_service" = "true" ]; then
   service deadline10launcher stop
   sudo killall -w deadlineworker || true
   service deadline10launcher start
diff --git a/packages/aws-rfdk/lib/deadline/scripts/bash/configureWorkerHealthCheck.sh b/packages/aws-rfdk/lib/deadline/scripts/bash/configureWorkerHealthCheck.sh
index 6f1eae011..777f45245 100644
--- a/packages/aws-rfdk/lib/deadline/scripts/bash/configureWorkerHealthCheck.sh
+++ b/packages/aws-rfdk/lib/deadline/scripts/bash/configureWorkerHealthCheck.sh
@@ -33,7 +33,7 @@ if [ ! -f "$DEADLINE_COMMAND" ]; then
 fi
 
 isVersionLessThan() {
-    python -c "import sys;sys.exit(0 if tuple(map(int, sys.argv[-2].split('.'))) < tuple(map(int, sys.argv[-1].split('.'))) else 1)" "$1" "$2"
+    python3 -c "import sys;sys.exit(0 if tuple(map(int, sys.argv[-2].split('.'))) < tuple(map(int, sys.argv[-1].split('.'))) else 1)" "$1" "$2"
 }
 
 DEADLINE_VERSION=$("$DEADLINE_COMMAND" -Version | grep -oP '[v]\K\d+\.\d+\.\d+\.\d+\b')
diff --git a/packages/aws-rfdk/lib/deadline/scripts/bash/getSecretToFile.sh b/packages/aws-rfdk/lib/deadline/scripts/bash/getSecretToFile.sh
index 51ddb95f3..b898aa1a0 100644
--- a/packages/aws-rfdk/lib/deadline/scripts/bash/getSecretToFile.sh
+++ b/packages/aws-rfdk/lib/deadline/scripts/bash/getSecretToFile.sh
@@ -32,10 +32,10 @@ export SECRET_JSON=$(aws --region ${AWS_REGION} secretsmanager get-secret-value
 set -x
 if printenv SECRET_JSON | grep 'SecretString' 2>&1 > /dev/null
 then
-    # Secret was plain test. Just copy the contents of the SecretString into the output file
-    printenv SECRET_JSON | python -c "${PY_SCRIPT}" SecretString > "${OUTPUT_FILENAME}"
+    # Secret was plain text. Just copy the contents of the SecretString into the output file
+    printenv SECRET_JSON | python3 -c "${PY_SCRIPT}" SecretString > "${OUTPUT_FILENAME}"
 else
     # Secret value is binary. The contents of SecretBinary will be the base64 encoding of the secret
-    printenv SECRET_JSON | python -c "${PY_SCRIPT}" SecretBinary | base64 -w0 -i -d > "${OUTPUT_FILENAME}"
+    printenv SECRET_JSON | python3 -c "${PY_SCRIPT}" SecretBinary | base64 -w0 -i -d > "${OUTPUT_FILENAME}"
 fi
 unset SECRET_JSON
diff --git a/packages/aws-rfdk/lib/deadline/test/asset-constants.ts b/packages/aws-rfdk/lib/deadline/test/asset-constants.ts
index 008f35d9f..e19cb0fd7 100644
--- a/packages/aws-rfdk/lib/deadline/test/asset-constants.ts
+++ b/packages/aws-rfdk/lib/deadline/test/asset-constants.ts
@@ -12,7 +12,7 @@ export const CONFIG_REPO_DIRECT_CONNECT_LINUX = {
 // configureWorker.sh
 export const CONFIG_WORKER_ASSET_LINUX = {
   Bucket: 'cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}',
-  Key: '1cfdffe73bb016717ba1f43d64fe528af27b3784f524a97bb36533a6e6d057ff',
+  Key: '76766750db1ed4977df23b4ebb558126969a4ee7b29abb6f641bbf01e5d87ee2',
 };
 
 // configureWorker.ps1
@@ -24,7 +24,7 @@ export const CONFIG_WORKER_ASSET_WINDOWS = {
 // configureWorkerHealthCheck.sh
 export const CONFIG_WORKER_HEALTHCHECK_LINUX = {
   Bucket: 'cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}',
-  Key: '3e16ffda458a50d2a032ef783202a85bf4677f19b92a38d3605d6cd750879f75',
+  Key: 'ead757e1f1f867645f8a576b3f882aa25c8c5412561d41b5276434f71b46062b',
 };
 
 // configureWorkerHealthCheck.ps1
@@ -47,7 +47,7 @@ export const CONFIG_WORKER_PORT_ASSET_WINDOWS = {
 // getSecretToFile.sh
 export const GET_SECRET_TO_FILE_SCRIPT_LINUX = {
   Bucket: 'cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}',
-  Key: '2245b375c979246094a6a47007b55e51f117e987be5de9791c0799cddc3f1c2e',
+  Key: '798b6fa13b77a35cae7f9eed2716de82efce89e61640d17dbd3c620f53613cec',
 };
 
 // installDeadlineRepository.sh
diff --git a/packages/aws-rfdk/lib/deadline/test/database-connection.test.ts b/packages/aws-rfdk/lib/deadline/test/database-connection.test.ts
index b1131a7dd..42af84ef6 100644
--- a/packages/aws-rfdk/lib/deadline/test/database-connection.test.ts
+++ b/packages/aws-rfdk/lib/deadline/test/database-connection.test.ts
@@ -128,7 +128,7 @@ describe('DocumentDB', () => {
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // WHEN
@@ -181,7 +181,7 @@ describe('DocumentDB', () => {
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // WHEN
@@ -213,7 +213,7 @@ describe('DocumentDB', () => {
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // WHEN
@@ -244,7 +244,7 @@ describe('DocumentDB', () => {
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // WHEN
@@ -535,7 +535,7 @@ describe('MongoDB', () => {
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // WHEN
@@ -561,7 +561,7 @@ describe('MongoDB', () => {
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // WHEN
@@ -623,7 +623,7 @@ describe('MongoDB', () => {
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // WHEN
diff --git a/packages/aws-rfdk/lib/deadline/test/render-queue.test.ts b/packages/aws-rfdk/lib/deadline/test/render-queue.test.ts
index 959d4ec51..658470759 100644
--- a/packages/aws-rfdk/lib/deadline/test/render-queue.test.ts
+++ b/packages/aws-rfdk/lib/deadline/test/render-queue.test.ts
@@ -209,7 +209,7 @@ describe('RenderQueue', () => {
           InstanceClass.R4,
           InstanceSize.LARGE,
         ),
-        machineImage: MachineImage.latestAmazonLinux2(),
+        machineImage: MachineImage.latestAmazonLinux2023(),
       });
 
       // WHEN
@@ -516,7 +516,7 @@ describe('RenderQueue', () => {
       // GIVEN
       const instance = new Instance(dependencyStack, 'BackendConnectionInstance', {
         instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MICRO),
-        machineImage: MachineImage.latestAmazonLinux2(),
+        machineImage: MachineImage.latestAmazonLinux2023(),
         vpc,
       });
       const portNumber = 5555;
@@ -1209,7 +1209,7 @@ describe('RenderQueue', () => {
             InstanceClass.R4,
             InstanceSize.LARGE,
           ),
-          machineImage: MachineImage.latestAmazonLinux2(),
+          machineImage: MachineImage.latestAmazonLinux2023(),
         })];
         const role = new Role(stack, 'Role', {assumedBy: new AccountRootPrincipal()});
 
@@ -1249,7 +1249,7 @@ describe('RenderQueue', () => {
             InstanceClass.R4,
             InstanceSize.LARGE,
           ),
-          machineImage: MachineImage.latestAmazonLinux2(),
+          machineImage: MachineImage.latestAmazonLinux2023(),
         });
 
         renderQueue.configureClientInstance({
@@ -1416,7 +1416,7 @@ describe('RenderQueue', () => {
             InstanceClass.R4,
             InstanceSize.LARGE,
           ),
-          machineImage: MachineImage.latestAmazonLinux2(),
+          machineImage: MachineImage.latestAmazonLinux2023(),
         })];
         const role = new Role(stack, 'Role', {assumedBy: new AccountRootPrincipal()});
 
@@ -1450,7 +1450,7 @@ describe('RenderQueue', () => {
             InstanceClass.R4,
             InstanceSize.LARGE,
           ),
-          machineImage: MachineImage.latestAmazonLinux2(),
+          machineImage: MachineImage.latestAmazonLinux2023(),
         });
 
         renderQueue.configureClientInstance({
diff --git a/packages/aws-rfdk/lib/deadline/test/repository.test.ts b/packages/aws-rfdk/lib/deadline/test/repository.test.ts
index dd7d4f8ef..efb868eda 100644
--- a/packages/aws-rfdk/lib/deadline/test/repository.test.ts
+++ b/packages/aws-rfdk/lib/deadline/test/repository.test.ts
@@ -930,7 +930,7 @@ test('repository configure client instance', () => {
   const instance = new Instance(stack, 'Instance', {
     vpc,
     instanceType: new InstanceType('t3.small'),
-    machineImage: MachineImage.latestAmazonLinux2(),
+    machineImage: MachineImage.latestAmazonLinux2023(),
   });
   const instanceRole = (
     instance
@@ -989,12 +989,12 @@ test('configureClientInstance uses singleton for repo config script', () => {
   const instance1 = new Instance(stack, 'Instance1', {
     vpc,
     instanceType: new InstanceType('t3.small'),
-    machineImage: MachineImage.latestAmazonLinux2(),
+    machineImage: MachineImage.latestAmazonLinux2023(),
   });
   const instance2 = new Instance(stack, 'Instance2', {
     vpc,
     instanceType: new InstanceType('t3.small'),
-    machineImage: MachineImage.latestAmazonLinux2(),
+    machineImage: MachineImage.latestAmazonLinux2023(),
   });
 
   // WHEN
diff --git a/packages/aws-rfdk/lib/deadline/test/worker-configuration.test.ts b/packages/aws-rfdk/lib/deadline/test/worker-configuration.test.ts
index 44363a34d..09681ef6a 100644
--- a/packages/aws-rfdk/lib/deadline/test/worker-configuration.test.ts
+++ b/packages/aws-rfdk/lib/deadline/test/worker-configuration.test.ts
@@ -59,7 +59,7 @@ describe('Test WorkerInstanceConfiguration for Linux', () => {
     instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
   });
 
@@ -468,7 +468,7 @@ describe('Test WorkerInstanceConfiguration connect to RenderQueue', () => {
     const instance = new Instance(stack, 'Instance', {
       vpc,
       instanceType: new InstanceType('t3.small'),
-      machineImage: MachineImage.latestAmazonLinux2(),
+      machineImage: MachineImage.latestAmazonLinux2023(),
     });
 
     // WHEN