diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 000000000..fcadb2cf9
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+* text eol=lf
diff --git a/.github/workflows/updatecli.yaml b/.github/workflows/action-updatecli.yaml
similarity index 71%
rename from .github/workflows/updatecli.yaml
rename to .github/workflows/action-updatecli.yaml
index d3eadd7e7..a8f84211c 100644
--- a/.github/workflows/updatecli.yaml
+++ b/.github/workflows/action-updatecli.yaml
@@ -18,11 +18,16 @@ jobs:
 
       - name: Install updatecli # Until https://github.com/updatecli/updatecli/pull/336
         run: |
-          curl -sSL https://github.com/updatecli/updatecli/releases/download/v0.16.1/updatecli_Linux_x86_64.tar.gz -o updatecli.tgz
+          curl -sSL https://github.com/updatecli/updatecli/releases/download/v0.23.2/updatecli_Linux_x86_64.tar.gz -o updatecli.tgz
           tar xzf updatecli.tgz -C /usr/local/bin
           updatecli version
           rm -f updatecli.tgz
 
+      - name: Install Jenkins Plugin Installation Manager Tool
+        run: |
+          curl -sSL https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.12.3/jenkins-plugin-manager-2.12.3.jar -o "${GITHUB_WORKSPACE:-.}/plugin-manager.jar"
+          echo "PLUGIN_MANAGER_JAR_PATH=$GITHUB_WORKSPACE/plugin-manager.jar" >> $GITHUB_ENV
+
       - name: Diff
         continue-on-error: true
         run: |
diff --git a/.gitignore b/.gitignore
index 737afc70d..337fa3e1a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,4 +6,4 @@ pct-report.*
 logs/
 megawar.war
 pct.jar
-
+plugin-manager.jar
diff --git a/updatecli/updatecli.d/update-plugins.ps1 b/updatecli/updatecli.d/update-plugins.ps1
new file mode 100644
index 000000000..acda77fc7
--- /dev/null
+++ b/updatecli/updatecli.d/update-plugins.ps1
@@ -0,0 +1,41 @@
+param(
+  [string] $JenkinsVersion,
+  [string] $PluginManagerJar = './plugin-manager.jar'
+)
+
+$JenkinsVersionX = $JenkinsVersion -replace '\d+$', 'x'
+
+if (Get-Command 'java' -ErrorAction SilentlyContinue) {
+  $java = 'java'
+} elseif ($IsLinux) {
+  $java = '/usr/bin/java'
+} else {
+  $java = 'java'
+}
+
+$pomPath = "bom-${JenkinsVersionX}/pom.xml"
+$pom = New-Object System.Xml.XmlDocument
+$pom.PreserveWhitespace = $true
+$pom.Load($pomPath)
+
+# Select Dependencies and Skip BOM
+$dependencies = $pom.Project.DependencyManagement.Dependencies.Dependency | Select-Object -Skip 1
+
+foreach ($dependency in $dependencies) {
+  $artifact = $dependency.artifactId
+  $oldVersion = $dependency.version
+  $plugin = "${artifact}:${oldVersion}"
+  [string] $output = & $java -jar "$PluginManagerJar" --no-download --available-updates --jenkins-version "$JenkinsVersion" --plugins $plugin
+  if ($null -ne $output -and $output -inotlike '*No available updates*') {
+    # Example output:
+    # Available updates:
+    # credentials (2.6.1) has an available update: 2.6.1.1
+
+    # Grab the version number at the end of the line
+    $newVersion = ($output | Select-String -Pattern 'update: (.+)').matches.Groups[1].Value
+    Write-Output "Changed $artifact from $oldVersion to $newVersion"
+    $dependency.version = $newVersion
+  }
+}
+
+$pom.Save($pomPath)
diff --git a/updatecli/updatecli.d/update-plugins.sh b/updatecli/updatecli.d/update-plugins.sh
new file mode 100755
index 000000000..b8005837b
--- /dev/null
+++ b/updatecli/updatecli.d/update-plugins.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -eux -o pipefail
+
+jenkinsVersion="$1"
+jar="${PLUGIN_MANAGER_JAR_PATH:-"./plugin-manager.jar"}"
+
+# check if jar does not exist
+if [ ! -f "$jar" ]; then
+  curl -sSL https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.12.3/jenkins-plugin-manager-2.12.3.jar -o "$jar"
+fi
+
+pwsh -NoProfile -File "./updatecli/updatecli.d/update-plugins.ps1" -JenkinsVersion "${jenkinsVersion}" -PluginManagerJar "${jar}"
diff --git a/updatecli/updatecli.d/update-plugins.yaml b/updatecli/updatecli.d/update-plugins.yaml
new file mode 100644
index 000000000..c8f3794d6
--- /dev/null
+++ b/updatecli/updatecli.d/update-plugins.yaml
@@ -0,0 +1,143 @@
+---
+scms:
+  github:
+    kind: github
+    spec:
+      user: "{{ .github.user }}"
+      email: "{{ .github.email }}"
+      owner: "{{ .github.owner }}"
+      repository: "{{ .github.repository }}"
+      token: "{{ requiredEnv .github.token }}"
+      username: "{{ .github.username }}"
+      branch: "{{ .github.branch }}"
+
+sources:
+  jenkins2.289.x:
+    name: Get Last Jenkins Stable Version
+    kind: githubrelease
+    spec:
+      owner: "jenkinsci"
+      repository: "jenkins"
+      token: "{{ requiredEnv .github.token }}"
+      versionfilter:
+        kind: regex
+        pattern: 'jenkins-2.289.\d+$'
+    transformers:
+      - trimPrefix: "jenkins-"
+  jenkins2.303.x:
+    name: Get Last Jenkins Stable Version
+    kind: githubrelease
+    spec:
+      owner: "jenkinsci"
+      repository: "jenkins"
+      token: "{{ requiredEnv .github.token }}"
+      versionfilter:
+        kind: regex
+        pattern: 'jenkins-2.303.\d+$'
+    transformers:
+      - trimPrefix: "jenkins-"
+  jenkins2.319.x:
+    name: Get Last Jenkins Stable Version
+    kind: githubrelease
+    spec:
+      owner: "jenkinsci"
+      repository: "jenkins"
+      token: "{{ requiredEnv .github.token }}"
+      versionfilter:
+        kind: regex
+        pattern: 'jenkins-2.319.\d+$'
+    transformers:
+      - trimPrefix: "jenkins-"
+  jenkins2.332.x:
+    name: Get Last Jenkins Stable Version
+    kind: githubrelease
+    spec:
+      owner: "jenkinsci"
+      repository: "jenkins"
+      token: "{{ requiredEnv .github.token }}"
+      versionfilter:
+        kind: regex
+        pattern: 'jenkins-2.332.\d+$'
+    transformers:
+      - trimPrefix: "jenkins-"
+conditions:
+  jenkins2.289.x:
+    name: Test if Jenkins stable published
+    kind: maven
+    sourceid: jenkins2.289.x
+    spec:
+      url: "repo.jenkins-ci.org"
+      repository: "releases"
+      groupid: "org.jenkins-ci.main"
+      artifactid: "jenkins-war"
+  jenkins2.303.x:
+    name: Test if Jenkins stable published
+    kind: maven
+    sourceid: jenkins2.303.x
+    spec:
+      url: "repo.jenkins-ci.org"
+      repository: "releases"
+      groupid: "org.jenkins-ci.main"
+      artifactid: "jenkins-war"
+  jenkins2.319.x:
+    name: Test if Jenkins stable published
+    kind: maven
+    sourceid: jenkins2.319.x
+    spec:
+      url: "repo.jenkins-ci.org"
+      repository: "releases"
+      groupid: "org.jenkins-ci.main"
+      artifactid: "jenkins-war"
+  jenkins2.332.x:
+    name: Test if Jenkins stable published
+    kind: maven
+    sourceid: jenkins2.332.x
+    spec:
+      url: "repo.jenkins-ci.org"
+      repository: "releases"
+      groupid: "org.jenkins-ci.main"
+      artifactid: "jenkins-war"
+targets:
+  jenkins2.289.x:
+    name: 'Update 2.289.x plugins'
+    sourceid: jenkins2.289.x
+    kind: shell
+    spec:
+      command: bash ./updatecli/updatecli.d/update-plugins.sh
+    scmid: github
+  jenkins2.303.x:
+    name: 'Update 2.303.x plugins'
+    sourceid: jenkins2.303.x
+    kind: shell
+    spec:
+      command: bash ./updatecli/updatecli.d/update-plugins.sh
+    scmid: github
+  jenkins2.319.x:
+    name: 'Update 2.319.x plugins'
+    sourceid: jenkins2.319.x
+    kind: shell
+    spec:
+      command: bash ./updatecli/updatecli.d/update-plugins.sh
+    scmid: github
+  jenkins2.332.x:
+    name: 'Update 2.332.x plugins'
+    sourceid: jenkins2.332.x
+    kind: shell
+    spec:
+      command: bash ./updatecli/updatecli.d/update-plugins.sh
+    scmid: github
+pullrequests:
+  default:
+    title: 'Bump pinned plugins'
+    kind: github
+    scmid: github
+    targets:
+      - jenkins2.289.x
+      - jenkins2.303.x
+      - jenkins2.319.x
+      - jenkins2.332.x
+    spec:
+      labels:
+        - dependencies
+      automerge: true
+      mergemethod: squash
diff --git a/updatecli/updatecli.d/weekly.yaml b/updatecli/updatecli.d/weekly.yaml
index d61fc8051..e2a31c53b 100644
--- a/updatecli/updatecli.d/weekly.yaml
+++ b/updatecli/updatecli.d/weekly.yaml
@@ -1,4 +1,16 @@
 ---
+scms:
+  github:
+    kind: github
+    spec:
+      user: "{{ .github.user }}"
+      email: "{{ .github.email }}"
+      owner: "{{ .github.owner }}"
+      repository: "{{ .github.repository }}"
+      token: "{{ requiredEnv .github.token }}"
+      username: "{{ .github.username }}"
+      branch: "{{ .github.branch }}"
+
 sources:
   jenkinsWeekly:
     name: Get Last Jenkins Weekly Version
@@ -13,27 +25,15 @@ conditions:
     name: Test if Jenkins weekly published
     kind: maven
     spec:
-      owner: "maven"
       url: "repo.jenkins-ci.org"
       repository: "releases"
-      groupID: "org.jenkins-ci.main"
-      artifactID: "jenkins-war"
+      groupid: "org.jenkins-ci.main"
+      artifactid: "jenkins-war"
 targets:
   default:
     name: 'Update weekly version'
-    sourceID: jenkinsWeekly
+    sourceid: jenkinsWeekly
     kind: shell
     spec:
       command: bash ./updatecli/updatecli.d/weekly-apply.sh
-    scm:
-      github:
-        user: "{{ .github.user }}"
-        email: "{{ .github.email }}"
-        owner: "{{ .github.owner }}"
-        repository: "{{ .github.repository }}"
-        token: "{{ requiredEnv .github.token }}"
-        username: "{{ .github.username }}"
-        branch: "{{ .github.branch }}"
-        pullRequest:
-          labels:
-            - dependencies
+    scmid: github
diff --git a/updatecli/values.yaml b/updatecli/values.yaml
index ac89ff522..971c817e8 100644
--- a/updatecli/values.yaml
+++ b/updatecli/values.yaml
@@ -5,4 +5,4 @@ github:
   token: "UPDATECLI_GITHUB_TOKEN"
   owner: "jenkinsci"
   repository: "bom"
-  branch: "master"
\ No newline at end of file
+  branch: "master"