diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cdd7011..463e681 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-24.04
@@ -16,7 +19,7 @@ jobs:
     - name: install build dependencies
       run: sudo apt-get update -y && sudo apt-get -qq -y install autoconf automake autotools-dev curl python3 libmpc-dev libmpfr-dev libgmp-dev gawk build-essential bison flex texinfo gperf libtool patchutils bc zlib1g-dev libexpat-dev
     - name: install OpenSBI dependencies
-      run: sudo apt-get update -y && sudo apt-get -qq -y install clang
+      run: sudo apt-get update -y && sudo apt-get -qq -y install clang libclang-dev llvm-dev
     - name: install Qemu dependencies
       run: sudo apt-get update -y && sudo apt-get -qq -y install git libglib2.0-dev libfdt-dev libpixman-1-dev zlib1g-dev ninja-build python3-venv libslirp-dev xz-utils
     - name: install Buildroot dependencies
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 5cb1725..a8ee449 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -3,6 +3,8 @@ name: Verification tests
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -47,7 +49,7 @@ jobs:
     - name: install build dependencies
       run: sudo apt -qq -y install wget autoconf automake autotools-dev curl python3 libmpc-dev libmpfr-dev libgmp-dev gawk build-essential bison flex texinfo gperf libtool patchutils bc zlib1g-dev libexpat-dev xz-utils
     - name: install OpenSBI dependencies
-      run: sudo apt -qq -y install clang
+      run: sudo apt -qq -y install clang libclang-dev llvm-dev
     - name: install Buildroot dependencies
       run: sudo apt -qq -y install unzip sed binutils diffutils build-essential bash patch gzip bzip2 perl tar cpio unzip rsync file bc findutils
     - name: make setup
diff --git a/Makefile b/Makefile
index c32084a..3f62a5d 100644
--- a/Makefile
+++ b/Makefile
@@ -82,7 +82,7 @@ emulator: setup devtools
 		wget https://download.qemu.org/qemu-$(QEMU_VERSION).tar.xz; \
 		tar xJf qemu-$(QEMU_VERSION).tar.xz; \
 		mv qemu-$(QEMU_VERSION)/* $(QEMU_SOURCE_DIR)/; \
-		./configure --prefix=$(QEMU_WORK_DIR) --enable-slirp --enable-kvm --target-list=riscv64-softmmu,riscv64-linux-user; \
+		./configure --prefix=$(QEMU_WORK_DIR) --enable-slirp --enable-kvm --target-list=riscv64-softmmu; \
 		PATH="$(RISCV_GNU_TOOLCHAIN_WORK_DIR)/bin:$(PATH)" $(MAKE) -C $(QEMU_SOURCE_DIR) >/dev/null; \
 		PATH="$(RISCV_GNU_TOOLCHAIN_WORK_DIR)/bin:$(PATH)" $(MAKE) -C $(QEMU_SOURCE_DIR) install; \
 	fi
diff --git a/README.md b/README.md
index 5f554b4..b5e8c5e 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,7 @@ sudo apt update
 sudo apt -qq -y install autoconf automake autotools-dev curl python3 libmpc-dev libmpfr-dev libgmp-dev gawk build-essential bison flex texinfo gperf libtool patchutils bc zlib1g-dev libexpat-dev xz-utils
 
 # OpenSBI
-sudo apt -qq -y install clang
+sudo apt -qq -y install clang libclang-dev llvm-dev
 
 # Qemu 8.2
 sudo apt -qq -y install git libglib2.0-dev libfdt-dev libpixman-1-dev zlib1g-dev ninja-build python3-venv libslirp-dev
diff --git a/security-monitor/Cargo.lock b/security-monitor/Cargo.lock
index 50e575b..56a530d 100644
--- a/security-monitor/Cargo.lock
+++ b/security-monitor/Cargo.lock
@@ -39,18 +39,18 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "bindgen"
@@ -61,21 +61,19 @@ dependencies = [
  "bitflags",
  "cexpr",
  "clang-sys",
- "log",
- "prettyplease",
  "proc-macro2",
  "quote",
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.107",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "block-buffer"
@@ -83,7 +81,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "hybrid-array 0.4.10",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -97,9 +95,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "cipher"
@@ -114,13 +112,12 @@ dependencies = [
 
 [[package]]
 name = "clang-sys"
-version = "1.8.1"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
 dependencies = [
  "glob",
  "libc",
- "libloading",
 ]
 
 [[package]]
@@ -150,7 +147,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "hybrid-array 0.4.10",
+ "hybrid-array",
  "rand_core",
 ]
 
@@ -218,16 +215,6 @@ dependencies = [
  "thiserror-no-std",
 ]
 
-[[package]]
-name = "generic-array"
-version = "1.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "985a5578ebdb02351d484a77fb27e7cb79272f1ba9bc24692d8243c3cfe40660"
-dependencies = [
- "rustversion",
- "typenum",
-]
-
 [[package]]
 name = "ghash"
 version = "0.6.0"
@@ -239,24 +226,15 @@ dependencies = [
 
 [[package]]
 name = "glob"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
 [[package]]
 name = "hybrid-array"
-version = "0.2.3"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2d35805454dc9f8662a98d6d61886ffe26bd465f5960e0e55345c70d5c0d2a9"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "hybrid-array"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
  "ctutils",
  "typenum",
@@ -268,7 +246,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
- "hybrid-array 0.4.10",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -293,31 +271,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.177"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
-
-[[package]]
-name = "libloading"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
-dependencies = [
- "cfg-if",
- "windows-link",
-]
-
-[[package]]
-name = "log"
-version = "0.4.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "memoffset"
@@ -349,7 +311,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e15f3e5b957493873e396a66914e83e616b6afe335cdef7efe5c6e1216aba66"
 dependencies = [
- "hybrid-array 0.4.10",
+ "hybrid-array",
  "kem",
  "module-lattice",
  "rand_core",
@@ -363,7 +325,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
 dependencies = [
  "ctutils",
- "hybrid-array 0.4.10",
+ "hybrid-array",
  "num-traits",
 ]
 
@@ -422,30 +384,20 @@ dependencies = [
  "universal-hash",
 ]
 
-[[package]]
-name = "prettyplease"
-version = "0.2.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn 2.0.107",
-]
-
 [[package]]
 name = "proc-macro2"
-version = "1.0.101"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.41"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
@@ -458,9 +410,9 @@ checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
 [[package]]
 name = "regex"
-version = "1.12.2"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -470,9 +422,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -481,9 +433,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "riscv-decode"
@@ -496,17 +448,16 @@ name = "riscv_cove_tap"
 version = "0.2.0"
 dependencies = [
  "aes-gcm",
- "generic-array",
- "hybrid-array 0.2.3",
+ "hybrid-array",
  "ml-kem",
  "thiserror-no-std",
 ]
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.1"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustc_version"
@@ -517,18 +468,12 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustversion"
-version = "1.0.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
-
 [[package]]
 name = "security-monitor"
 version = "0.4.0"
 dependencies = [
  "flattened_device_tree",
- "hybrid-array 0.4.10",
+ "hybrid-array",
  "memoffset 0.9.1",
  "opensbi-sys",
  "pointers_utility",
@@ -572,9 +517,9 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "spin"
-version = "0.12.2"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8abadc99fd9c7bbb7d0ca2b31d72a067d0c0dcd7aad25ab8cac71ba91417694b"
+checksum = "0134f9043ed38b087ac4f7d4af44c79e2c9e5094421fe3164f435ce585953b10"
 
 [[package]]
 name = "static_assertions"
@@ -595,9 +540,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.107"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a26dbd934e5451d21ef060c018dae56fc073894c5a7896f882928a76e6d081b"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -626,15 +571,15 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.19"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
 [[package]]
 name = "universal-hash"
@@ -651,9 +596,3 @@ name = "unsafe_unwrap"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1230ec65f13e0f9b28d789da20d2d419511893ea9dac2c1f4ef67b8b14e5da80"
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
diff --git a/security-monitor/Cargo.toml b/security-monitor/Cargo.toml
index a8f7a36..a410ce4 100644
--- a/security-monitor/Cargo.toml
+++ b/security-monitor/Cargo.toml
@@ -2,7 +2,7 @@
 name = "security-monitor"
 version = "0.4.0"
 authors = ["Wojciech Ozga <woz@zurich.ibm.com>"]
-description = "Assured Confidential Execution (ACE): security monitor implementation targetting RISC-V"
+description = "Assured Confidential Execution (ACE): TEE Security Manager (TSM) implementation targetting RISC-V CoVE"
 edition = "2024"
 
 [dependencies]
@@ -22,7 +22,7 @@ opensbi-sys = {path = "rust-crates/opensbi-sys"}
 pointers_utility = {path = "rust-crates/pointers_utility"}
 
 # This crate decodes RISC-V instructions unfortunately it does not support the C-instructions yet
-riscv-decode = "0.2"
+riscv-decode = {version = "0.2", default-features=false }
 
 # The `spin` crate provides synchronization primitives (Mutexes etc) using spinlocks
 spin = {version="0.12", default-features = false, features = ["once", "rwlock", "spin_mutex"]}
diff --git a/security-monitor/rust-crates/opensbi-sys/Cargo.toml b/security-monitor/rust-crates/opensbi-sys/Cargo.toml
index 431463e..599ca14 100644
--- a/security-monitor/rust-crates/opensbi-sys/Cargo.toml
+++ b/security-monitor/rust-crates/opensbi-sys/Cargo.toml
@@ -7,4 +7,4 @@ build = "build.rs"
 edition = "2024"
 
 [build-dependencies]
-bindgen = "0.73"
\ No newline at end of file
+bindgen = {version="0.73", default-features=false}
\ No newline at end of file
diff --git a/security-monitor/rust-crates/riscv_cove_tap/Cargo.toml b/security-monitor/rust-crates/riscv_cove_tap/Cargo.toml
index c903ebd..291eecc 100644
--- a/security-monitor/rust-crates/riscv_cove_tap/Cargo.toml
+++ b/security-monitor/rust-crates/riscv_cove_tap/Cargo.toml
@@ -2,18 +2,17 @@
 name = "riscv_cove_tap"
 version = "0.2.0"
 authors = ["Wojciech Ozga <woz@zurich.ibm.com>"]
-description = "Library to parse the RISC-V CoVE's TEE attestation payload"
+description = "Library to parse the RISC-V CoVE's TEE attestation payload (TAP)"
 edition = "2024"
 
 [dependencies]
-rand = {version = "0.10", optional=true}
+rand = {version = "0.10", default-features=false, optional=true, features=["thread_rng"] }
 
-hybrid-array = "0.2.3"
+hybrid-array = {version = "0.4", default-features=false }
 ml-kem = {version = "0.3.2", default-features=false, features = [] }
 
 # for symmetric encryption of payload
-aes-gcm = {version="0.11.1", default-features = false, features=["aes", "alloc", "rand_core"]}
-generic-array = "1"
+aes-gcm = {version="0.11", default-features = false, features=["aes", "alloc", "rand_core"]}
 
 # provides macros that help removing boilerplate code in rust error handling
 thiserror-no-std = "2.0"
diff --git a/security-monitor/src/non_confidential_flow/handlers/cove_host_extension/promote_to_confidential_vm.rs b/security-monitor/src/non_confidential_flow/handlers/cove_host_extension/promote_to_confidential_vm.rs
index f202ee0..4564e96 100644
--- a/security-monitor/src/non_confidential_flow/handlers/cove_host_extension/promote_to_confidential_vm.rs
+++ b/security-monitor/src/non_confidential_flow/handlers/cove_host_extension/promote_to_confidential_vm.rs
@@ -125,6 +125,7 @@ impl PromoteToConfidentialVm {
         let mut measurements = StaticMeasurements::default();
         memory_protector.finalize(&mut measurements, vm_memory_layout)?;
         confidential_harts[Self::BOOT_HART_ID].measure(measurements.pcr_boot_hart_mut());
+        // codeql[rust/cleartext-logging] - digest values intentionally logged in debug builds
         debug!("VM measurements: {:?}", measurements);
         Ok(measurements)
     }
@@ -204,6 +205,7 @@ impl PromoteToConfidentialVm {
             Some(attestation_payload) => {
                 ensure!(attestation_payload.digests.len() > 0, Error::LocalAttestationFailed())?;
                 for digest in attestation_payload.digests.iter() {
+                    // codeql[rust/cleartext-logging] - digest values intentionally logged in debug builds
                     debug!("Reference PCR{:?}={:?}=0x{}", digest.pcr_id, digest.algorithm, digest.value_in_hex());
                     ensure!(digest.algorithm == riscv_cove_tap::DigestAlgorithm::Sha512, Error::LocalAttestationNotSupportedDigest())?;
                     let pcr_value = MeasurementDigest::try_from(digest.value.as_slice()).map_err(|_| Error::LocalAttestationFailed())?;
diff --git a/tools/ace_connect.sh b/tools/ace_connect.sh
index 6b1e25d..12b5478 100755
--- a/tools/ace_connect.sh
+++ b/tools/ace_connect.sh
@@ -9,7 +9,7 @@ if [ -z ${ACE_DIR} ]; then
 fi
 
 # load common configuration
-. common.sh
+. ${ACE_DIR}/tools/common.sh
 
 HYPERVISOR_TEST_PORT=$2
 
diff --git a/tools/ace_start.sh b/tools/ace_start.sh
index c284641..3f2ed0c 100755
--- a/tools/ace_start.sh
+++ b/tools/ace_start.sh
@@ -9,7 +9,7 @@ if [ -z ${ACE_DIR} ]; then
 fi
 
 # load common configuration
-. common.sh
+. ${ACE_DIR}/tools/common.sh
 
 # start the VM
 ${ACE_DIR}/tools/ace_run_hypervisor.sh --daemonize > .run_tests.log
diff --git a/tools/ace_stop.sh b/tools/ace_stop.sh
index 7985594..66a65b9 100755
--- a/tools/ace_stop.sh
+++ b/tools/ace_stop.sh
@@ -3,7 +3,12 @@
 # SPDX-FileContributor: Wojciech Ozga <woz@zurich.ibm.com>, IBM Research - Zurich
 # SPDX-License-Identifier: Apache-2.0
 
+if [ -z ${ACE_DIR} ]; then
+    echo "ACE_DIR must point to the directory where ACE is installed"
+    exit 1
+fi
+
 # load common configuration
-. common.sh
+. ${ACE_DIR}/tools/common.sh
 
 kill_users_qemu
\ No newline at end of file
diff --git a/tools/ace_test.sh b/tools/ace_test.sh
index d90c797..8936305 100755
--- a/tools/ace_test.sh
+++ b/tools/ace_test.sh
@@ -9,7 +9,7 @@ if [ -z ${ACE_DIR} ]; then
 fi
 
 # load common configuration
-. common.sh
+. ${ACE_DIR}/tools/common.sh
 
 # start the VM
 ${ACE_DIR}/tools/ace_run_hypervisor.sh --daemonize > .run_tests.log
diff --git a/tools/cove_tap_tool/Cargo.lock b/tools/cove_tap_tool/Cargo.lock
index f87d042..f5a4036 100644
--- a/tools/cove_tap_tool/Cargo.lock
+++ b/tools/cove_tap_tool/Cargo.lock
@@ -93,19 +93,13 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
-[[package]]
-name = "base64ct"
-version = "1.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
-
 [[package]]
 name = "block-buffer"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
- "hybrid-array 0.4.15",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -203,12 +197,6 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
 [[package]]
 name = "cove-tap-tool"
 version = "0.1.0"
@@ -217,11 +205,11 @@ dependencies = [
  "byteorder",
  "clap",
  "clap-num",
- "hybrid-array 0.4.15",
+ "hybrid-array",
  "ml-kem",
  "rand",
  "riscv_cove_tap",
- "sha3",
+ "sha3 0.12.0",
  "thiserror",
 ]
 
@@ -247,7 +235,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
  "getrandom",
- "hybrid-array 0.4.15",
+ "hybrid-array",
  "rand_core",
 ]
 
@@ -269,16 +257,6 @@ dependencies = [
  "cmov",
 ]
 
-[[package]]
-name = "der"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
-dependencies = [
- "const-oid",
- "zeroize",
-]
-
 [[package]]
 name = "digest"
 version = "0.11.3"
@@ -286,20 +264,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer",
- "const-oid",
  "crypto-common",
 ]
 
-[[package]]
-name = "generic-array"
-version = "1.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "337d46834ee672ab3e48caca2cb0c78cc174fb12b3a68d0d88f99a0519a5e36e"
-dependencies = [
- "rustversion",
- "typenum",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.4.3"
@@ -327,15 +294,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hybrid-array"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2d35805454dc9f8662a98d6d61886ffe26bd465f5960e0e55345c70d5c0d2a9"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "hybrid-array"
 version = "0.4.15"
@@ -352,7 +310,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
- "hybrid-array 0.4.15",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -393,12 +351,11 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e15f3e5b957493873e396a66914e83e616b6afe335cdef7efe5c6e1216aba66"
 dependencies = [
- "hybrid-array 0.4.15",
+ "hybrid-array",
  "kem",
  "module-lattice",
- "pkcs8",
  "rand_core",
- "sha3",
+ "sha3 0.11.0",
 ]
 
 [[package]]
@@ -408,7 +365,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
 dependencies = [
  "ctutils",
- "hybrid-array 0.4.15",
+ "hybrid-array",
  "num-traits",
 ]
 
@@ -427,16 +384,6 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
-[[package]]
-name = "pkcs8"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
-dependencies = [
- "der",
- "spki",
-]
-
 [[package]]
 name = "polyval"
 version = "0.7.3"
@@ -494,19 +441,12 @@ name = "riscv_cove_tap"
 version = "0.2.0"
 dependencies = [
  "aes-gcm",
- "generic-array",
- "hybrid-array 0.2.3",
+ "hybrid-array",
  "ml-kem",
  "rand",
  "thiserror-no-std",
 ]
 
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
 [[package]]
 name = "sha3"
 version = "0.11.0"
@@ -518,15 +458,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "spki"
-version = "0.8.0"
+name = "sha3"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
+checksum = "bc9bad02c26382724b2d2692c6f179285e4b54eeecd7968f52a50059c3c11759"
 dependencies = [
- "base64ct",
- "der",
+ "digest",
+ "keccak",
+ "sponge-cursor",
 ]
 
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -557,18 +504,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -637,9 +584,3 @@ checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
  "windows-link",
 ]
-
-[[package]]
-name = "zeroize"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
diff --git a/tools/cove_tap_tool/Cargo.toml b/tools/cove_tap_tool/Cargo.toml
index e33e2b8..31f60b4 100644
--- a/tools/cove_tap_tool/Cargo.toml
+++ b/tools/cove_tap_tool/Cargo.toml
@@ -7,13 +7,14 @@ edition = "2021"
 
 [dependencies]
 clap = { version="4.6", features = ["derive"] } # for command line argument parsing
-clap-num = "1.2.0"
-byteorder = "1.5" # to serialize numbers using little/big endianness
-rand = "0.10"
-sha3 = "0.11" # to calculate integrity measurements of kernel, initramfs etc.
-hybrid-array = "0.4"
-ml-kem = "0.3.2"
-aes-gcm = {version="0.11.1", features=["aes", "alloc", "rand_core"]}
+clap-num = {version = "1.2", default-features=false }
+byteorder = {version = "1.5", default-features=false, features = ["std"] } # to serialize numbers using little/big endianness
+rand = {version = "0.10", default-features=false, features = ["std"] }
+sha3 = {version = "0.12", default-features=false } # to calculate integrity measurements of kernel, initramfs etc.
+hybrid-array = {version = "0.4", default-features=false }
+ml-kem = {version = "0.3", default-features=false }
+aes-gcm = {version="0.11", features=["aes", "alloc", "rand_core"]}
+
 riscv_cove_tap = {path="../../security-monitor/rust-crates/riscv_cove_tap", features=["parser", "serializer"]}
 
 thiserror = "2.0"  # provides macros that help removing boilerplate code in the rust error handling
diff --git a/tools/cove_tap_tool/src/generate.rs b/tools/cove_tap_tool/src/generate.rs
index 02b0d5c..adeb583 100644
--- a/tools/cove_tap_tool/src/generate.rs
+++ b/tools/cove_tap_tool/src/generate.rs
@@ -57,6 +57,7 @@ pub fn generate_tap(
             algorithm: DigestAlgorithm::Sha512,
             value: pcr_value,
         };
+        // codeql[rust/cleartext-logging] - intentional operator output for CLI tool
         println!("Writing PCR{}={}", pcr_id, tap_digest.value_in_hex());
         digests.push(tap_digest);
     }
@@ -67,6 +68,7 @@ pub fn generate_tap(
             name: secret_name,
             value: secret_value,
         };
+        // codeql[rust/cleartext-logging] - intentional operator output for CLI tool
         println!("Writing secret {}", secret_name);
         secrets.push(secret);
     }
diff --git a/tools/objdump_baremetal.sh b/tools/objdump_baremetal.sh
index a65d6e0..0e60370 100755
--- a/tools/objdump_baremetal.sh
+++ b/tools/objdump_baremetal.sh
@@ -3,4 +3,9 @@
 # SPDX-FileContributor: Wojciech Ozga <woz@zurich.ibm.com>, IBM Research - Zurich
 # SPDX-License-Identifier: Apache-2.0
 
-riscv64-linux-gnu-objdump -S /opt/ace-woz/buildroot/target/root/harness/baremetal
+if [ -z ${ACE_DIR} ]; then
+    echo "ACE_DIR must point to the directory where ACE is installed"
+    exit 1
+fi
+
+riscv64-linux-gnu-objdump -S ${ACE_DIR}/security-monitor/opensbi/platform/generic/firmware/fw_payload.elf