diff --git a/puppet/zulip/manifests/apache_sso.pp b/puppet/zulip/manifests/apache_sso.pp
index 2991c1a2d5..79377e8abc 100644
--- a/puppet/zulip/manifests/apache_sso.pp
+++ b/puppet/zulip/manifests/apache_sso.pp
@@ -1,7 +1,7 @@
 class zulip::apache_sso {
   include zulip::localhost_sso
 
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $apache_packages = [ 'apache2', 'libapache2-mod-wsgi-py3', ]
       $conf_dir = '/etc/apache2'
diff --git a/puppet/zulip/manifests/app_frontend_base.pp b/puppet/zulip/manifests/app_frontend_base.pp
index 1b8b7460eb..cc7e60184e 100644
--- a/puppet/zulip/manifests/app_frontend_base.pp
+++ b/puppet/zulip/manifests/app_frontend_base.pp
@@ -7,7 +7,7 @@ class zulip::app_frontend_base {
   include zulip::tornado_sharding
   include zulip::hooks::base
 
-  if $::os['family'] == 'Debian' {
+  if $facts['os']['family'] == 'Debian' {
     # Upgrade and other tooling wants to be able to get a database
     # shell.  This is not necessary on CentOS because the PostgreSQL
     # package already includes the client.
diff --git a/puppet/zulip/manifests/apt_repository.pp b/puppet/zulip/manifests/apt_repository.pp
index ad64914d72..b850558cb7 100644
--- a/puppet/zulip/manifests/apt_repository.pp
+++ b/puppet/zulip/manifests/apt_repository.pp
@@ -1,5 +1,5 @@
 class zulip::apt_repository {
-  $setup_apt_repo_file = "${::zulip_scripts_path}/lib/setup-apt-repo"
+  $setup_apt_repo_file = "${facts['zulip_scripts_path']}/lib/setup-apt-repo"
   exec{'setup_apt_repo':
     command => "bash -c '${setup_apt_repo_file}'",
     unless  => "bash -c '${setup_apt_repo_file} --verify'",
diff --git a/puppet/zulip/manifests/common.pp b/puppet/zulip/manifests/common.pp
index 5768f4734b..56e365e8dc 100644
--- a/puppet/zulip/manifests/common.pp
+++ b/puppet/zulip/manifests/common.pp
@@ -1,6 +1,6 @@
 class zulip::common {
   # Common parameters
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $nagios_plugins = 'monitoring-plugins-basic'
       $nagios_plugins_dir = '/usr/lib/nagios/plugins'
@@ -39,10 +39,10 @@ class zulip::common {
   }
   $supervisor_conf_dir = "${supervisor_system_conf_dir}/zulip"
 
-  $total_memory_bytes = $::memory['system']['total_bytes']
+  $total_memory_bytes = $facts['memory']['system']['total_bytes']
   $total_memory_mb = $total_memory_bytes / 1024 / 1024
 
-  $goarch = $::os['architecture'] ? {
+  $goarch = $facts['os']['architecture'] ? {
     'amd64'   => 'amd64',
     'aarch64' => 'arm64',
   }
diff --git a/puppet/zulip/manifests/external_dep.pp b/puppet/zulip/manifests/external_dep.pp
index e275fed7b9..0886528db0 100644
--- a/puppet/zulip/manifests/external_dep.pp
+++ b/puppet/zulip/manifests/external_dep.pp
@@ -9,7 +9,7 @@ define zulip::external_dep(
     if $zulip::common::versions[$title]['sha256'] =~ Hash {
       $sha256_filled = $zulip::common::versions[$title]['sha256'][$::os['architecture']]
       if $sha256_filled == undef {
-        err("No sha256 found for ${title} for architecture ${::os['architecture']}")
+        err("No sha256 found for ${title} for architecture ${facts['os']['architecture']}")
         fail()
       }
     } else {
diff --git a/puppet/zulip/manifests/hooks/sentry.pp b/puppet/zulip/manifests/hooks/sentry.pp
index 759f136b88..3623a7e28b 100644
--- a/puppet/zulip/manifests/hooks/sentry.pp
+++ b/puppet/zulip/manifests/hooks/sentry.pp
@@ -5,7 +5,7 @@ class zulip::hooks::sentry {
   $version = $zulip::common::versions['sentry-cli']['version']
   $bin = "/srv/zulip-sentry-cli-${version}"
 
-  $arch = $::os['architecture'] ? {
+  $arch = $facts['os']['architecture'] ? {
     'amd64'   => 'x86_64',
     'aarch64' => 'aarch64',
   }
diff --git a/puppet/zulip/manifests/nginx.pp b/puppet/zulip/manifests/nginx.pp
index 49c08dd138..48d4d56a46 100644
--- a/puppet/zulip/manifests/nginx.pp
+++ b/puppet/zulip/manifests/nginx.pp
@@ -6,7 +6,7 @@ class zulip::nginx {
   ]
   package { $web_packages: ensure => installed }
 
-  if $::os['family'] == 'RedHat' {
+  if $facts['os']['family'] == 'RedHat' {
     file { '/etc/nginx/sites-available':
       ensure => directory,
       owner  => 'root',
@@ -39,7 +39,7 @@ class zulip::nginx {
     source  => 'puppet:///modules/zulip/nginx/dhparam.pem',
   }
 
-  if $::os['family'] == 'Debian' {
+  if $facts['os']['family'] == 'Debian' {
       $ca_crt = '/etc/ssl/certs/ca-certificates.crt'
   } else {
       $ca_crt = '/etc/pki/tls/certs/ca-bundle.crt'
@@ -107,6 +107,6 @@ class zulip::nginx {
   }
 
   service { 'nginx':
-    ensure     => running,
+    ensure => running,
   }
 }
diff --git a/puppet/zulip/manifests/postgresql_base.pp b/puppet/zulip/manifests/postgresql_base.pp
index 3ae241d4e7..14fb41411d 100644
--- a/puppet/zulip/manifests/postgresql_base.pp
+++ b/puppet/zulip/manifests/postgresql_base.pp
@@ -3,7 +3,7 @@ class zulip::postgresql_base {
   include zulip::postgresql_common
   include zulip::process_fts_updates
 
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $postgresql = "postgresql-${zulip::postgresql_common::version}"
       $postgresql_sharedir = "/usr/share/postgresql/${zulip::postgresql_common::version}"
@@ -79,7 +79,7 @@ class zulip::postgresql_base {
     # Removed 2020-12 in version 4.0; these lines can be removed when
     # we drop support for upgrading from Zulip 3 or older.
     package{"${postgresql}-pgroonga":
-      ensure  => purged,
+      ensure => purged,
     }
 
     package{"${postgresql}-pgdg-pgroonga":
@@ -96,7 +96,7 @@ class zulip::postgresql_base {
           test "$(dpkg-query --show --showformat='\${Version}' "${postgresql}-pgdg-pgroonga")" \
              = "$(cat ${pgroonga_setup_sql_path}.applied)"
           | EOT
-      command => "${::zulip_scripts_path}/setup/pgroonga-config ${postgresql_sharedir}",
+      command => "${facts['zulip_scripts_path']}/setup/pgroonga-config ${postgresql_sharedir}",
     }
   }
 
@@ -106,7 +106,7 @@ class zulip::postgresql_base {
     include zulip::postgresql_backups
   } else {
     file { '/etc/cron.d/pg_backup_and_purge':
-      ensure  => absent,
+      ensure => absent,
     }
   }
 }
diff --git a/puppet/zulip/manifests/postgresql_common.pp b/puppet/zulip/manifests/postgresql_common.pp
index b056fbda27..961cdfe0f0 100644
--- a/puppet/zulip/manifests/postgresql_common.pp
+++ b/puppet/zulip/manifests/postgresql_common.pp
@@ -1,7 +1,7 @@
 class zulip::postgresql_common {
   include zulip::snakeoil
   $version = zulipconf('postgresql', 'version', undef)
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $postgresql = "postgresql-${version}"
       $postgresql_packages = [
@@ -63,7 +63,7 @@ class zulip::postgresql_common {
     require => Exec['generate-default-snakeoil'],
   }
 
-  if $::os['family'] == 'Debian' {
+  if $facts['os']['family'] == 'Debian' {
     # The logrotate file only created in debian-based systems
     exec { 'disable_logrotate':
       # lint:ignore:140chars
diff --git a/puppet/zulip/manifests/process_fts_updates.pp b/puppet/zulip/manifests/process_fts_updates.pp
index 2c2aaf6dc9..afeb7a5c30 100644
--- a/puppet/zulip/manifests/process_fts_updates.pp
+++ b/puppet/zulip/manifests/process_fts_updates.pp
@@ -1,6 +1,6 @@
 class zulip::process_fts_updates {
   include zulip::supervisor
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $fts_updates_packages = [
         # Needed to run process_fts_updates
diff --git a/puppet/zulip/manifests/profile/app_frontend.pp b/puppet/zulip/manifests/profile/app_frontend.pp
index 29f1070449..3121d6153d 100644
--- a/puppet/zulip/manifests/profile/app_frontend.pp
+++ b/puppet/zulip/manifests/profile/app_frontend.pp
@@ -10,7 +10,7 @@ class zulip::profile::app_frontend {
   } else {
     $nginx_listen_port = zulipconf('application_server', 'nginx_listen_port', 443)
   }
-  $ssl_dir = $::os['family'] ? {
+  $ssl_dir = $facts['os']['family'] ? {
     'Debian' => '/etc/ssl',
     'RedHat' => '/etc/pki/tls',
   }
@@ -61,7 +61,7 @@ class zulip::profile::app_frontend {
           test -d /etc/letsencrypt/renewal &&
           grep -qx "authenticator = standalone" /etc/letsencrypt/renewal/*.conf
           | EOT
-        command => "${::zulip_scripts_path}/lib/fix-standalone-certbot",
+        command => "${facts['zulip_scripts_path']}/lib/fix-standalone-certbot",
       }
   }
 
diff --git a/puppet/zulip/manifests/profile/base.pp b/puppet/zulip/manifests/profile/base.pp
index 265b768b73..110d067993 100644
--- a/puppet/zulip/manifests/profile/base.pp
+++ b/puppet/zulip/manifests/profile/base.pp
@@ -5,7 +5,7 @@
 class zulip::profile::base {
   include zulip::timesync
   include zulip::common
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       include zulip::apt_repository
     }
@@ -16,7 +16,7 @@ class zulip::profile::base {
       fail('osfamily not supported')
     }
   }
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $base_packages = [
         # Basics
diff --git a/puppet/zulip/manifests/profile/memcached.pp b/puppet/zulip/manifests/profile/memcached.pp
index 1008dff962..25e2284e60 100644
--- a/puppet/zulip/manifests/profile/memcached.pp
+++ b/puppet/zulip/manifests/profile/memcached.pp
@@ -3,7 +3,7 @@ class zulip::profile::memcached {
   include zulip::sasl_modules
   include zulip::systemd_daemon_reload
 
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $memcached_packages = [ 'memcached', 'sasl2-bin' ]
       $memcached_user = 'memcache'
diff --git a/puppet/zulip/manifests/profile/rabbitmq.pp b/puppet/zulip/manifests/profile/rabbitmq.pp
index 88df3fcd36..4a31cc24d1 100644
--- a/puppet/zulip/manifests/profile/rabbitmq.pp
+++ b/puppet/zulip/manifests/profile/rabbitmq.pp
@@ -1,6 +1,6 @@
 class zulip::profile::rabbitmq {
   include zulip::profile::base
-  $erlang = $::os['family'] ? {
+  $erlang = $facts['os']['family'] ? {
     'Debian' => 'erlang-base',
     'RedHat' => 'erlang',
   }
@@ -50,7 +50,7 @@ class zulip::profile::rabbitmq {
     notify => Service['rabbitmq-server'],
   }
   exec { 'warn-rabbitmq-nodename-change':
-    command   => "${::zulip_scripts_path}/lib/warn-rabbitmq-nodename-change",
+    command   => "${facts['zulip_scripts_path']}/lib/warn-rabbitmq-nodename-change",
     onlyif    => '[ -f /etc/rabbitmq/rabbitmq-env.conf ] && ! grep -xq NODENAME=zulip@localhost /etc/rabbitmq/rabbitmq-env.conf',
     before    => [
       File['/etc/rabbitmq/rabbitmq-env.conf'],
@@ -72,7 +72,7 @@ class zulip::profile::rabbitmq {
     ],
   }
   package { $rabbitmq_packages:
-    ensure  => installed,
+    ensure => installed,
   }
   # epmd doesn't have an init script, so we just check if it is
   # running, and if it isn't, start it.  Even in case of a race, this
@@ -94,7 +94,7 @@ class zulip::profile::rabbitmq {
   }
 
   exec { 'configure-rabbitmq':
-    command     => "${::zulip_scripts_path}/setup/configure-rabbitmq",
+    command     => "${facts['zulip_scripts_path']}/setup/configure-rabbitmq",
     refreshonly => true,
     require     => Service['rabbitmq-server'],
   }
diff --git a/puppet/zulip/manifests/profile/redis.pp b/puppet/zulip/manifests/profile/redis.pp
index f6ed549c00..8490df71d6 100644
--- a/puppet/zulip/manifests/profile/redis.pp
+++ b/puppet/zulip/manifests/profile/redis.pp
@@ -1,6 +1,6 @@
 class zulip::profile::redis {
   include zulip::profile::base
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $redis = 'redis-server'
       $redis_dir = '/etc/redis'
diff --git a/puppet/zulip/manifests/sasl_modules.pp b/puppet/zulip/manifests/sasl_modules.pp
index 02dc1a1c76..b7c4d278bb 100644
--- a/puppet/zulip/manifests/sasl_modules.pp
+++ b/puppet/zulip/manifests/sasl_modules.pp
@@ -1,5 +1,5 @@
 class zulip::sasl_modules {
-  $sasl_module_packages = $::os['family'] ? {
+  $sasl_module_packages = $facts['os']['family'] ? {
     'Debian' => [ 'libsasl2-modules' ],
     'RedHat' => [ 'cyrus-sasl-plain' ],
   }
diff --git a/puppet/zulip/manifests/sha256_file_to.pp b/puppet/zulip/manifests/sha256_file_to.pp
index a95acb883f..b6a4e236f6 100644
--- a/puppet/zulip/manifests/sha256_file_to.pp
+++ b/puppet/zulip/manifests/sha256_file_to.pp
@@ -6,7 +6,7 @@ define zulip::sha256_file_to(
   String $install_to,
 ) {
   exec { $url:
-    command => "${::zulip_scripts_path}/setup/sha256-file-to ${sha256} ${url} ${install_to}",
+    command => "${facts['zulip_scripts_path']}/setup/sha256-file-to ${sha256} ${url} ${install_to}",
     creates => $install_to,
     timeout => 600,
   }
diff --git a/puppet/zulip/manifests/sha256_tarball_to.pp b/puppet/zulip/manifests/sha256_tarball_to.pp
index 5a1d8601cc..854c6b7618 100644
--- a/puppet/zulip/manifests/sha256_tarball_to.pp
+++ b/puppet/zulip/manifests/sha256_tarball_to.pp
@@ -7,7 +7,7 @@ define zulip::sha256_tarball_to(
   String $install_to,
 ) {
   exec { $url:
-    command => "${::zulip_scripts_path}/setup/sha256-tarball-to ${sha256} ${url} ${install_from} ${install_to}",
+    command => "${facts['zulip_scripts_path']}/setup/sha256-tarball-to ${sha256} ${url} ${install_from} ${install_to}",
     creates => $install_to,
     timeout => 600,
   }
diff --git a/puppet/zulip/manifests/static_asset_compiler.pp b/puppet/zulip/manifests/static_asset_compiler.pp
index dd96c6415b..24656c1e30 100644
--- a/puppet/zulip/manifests/static_asset_compiler.pp
+++ b/puppet/zulip/manifests/static_asset_compiler.pp
@@ -1,5 +1,5 @@
 class zulip::static_asset_compiler {
-  case $::os['family'] {
+  case $facts['os']['family'] {
     'Debian': {
       $static_asset_compiler_packages = [
         # Used by makemessages i18n
diff --git a/puppet/zulip/manifests/tornado_sharding.pp b/puppet/zulip/manifests/tornado_sharding.pp
index 89a8580b3c..d474abdd49 100644
--- a/puppet/zulip/manifests/tornado_sharding.pp
+++ b/puppet/zulip/manifests/tornado_sharding.pp
@@ -34,8 +34,8 @@ class zulip::tornado_sharding {
   # This creates .tmp files which scripts/refresh-sharding-and-restart
   # moves into place
   exec { 'stage_updated_sharding':
-    command   => "${::zulip_scripts_path}/lib/sharding.py",
-    onlyif    => "${::zulip_scripts_path}/lib/sharding.py --errors-ok",
+    command   => "${facts['zulip_scripts_path']}/lib/sharding.py",
+    onlyif    => "${facts['zulip_scripts_path']}/lib/sharding.py --errors-ok",
     require   => [File['/etc/zulip/nginx_sharding_map.conf'], File['/etc/zulip/sharding.json']],
     logoutput => true,
     loglevel  => warning,
diff --git a/puppet/zulip/manifests/yum_repository.pp b/puppet/zulip/manifests/yum_repository.pp
index 43e4a5b091..ba8a74bc14 100644
--- a/puppet/zulip/manifests/yum_repository.pp
+++ b/puppet/zulip/manifests/yum_repository.pp
@@ -1,5 +1,5 @@
 class zulip::yum_repository {
-  $setup_yum_repo_file = "${::zulip_scripts_path}/lib/setup-yum-repo"
+  $setup_yum_repo_file = "${facts['zulip_scripts_path']}/lib/setup-yum-repo"
   exec{'setup_yum_repo':
     command => "bash -c '${setup_yum_repo_file} --prod'",
   }
diff --git a/puppet/zulip_ops/manifests/ksplice_uptrack.pp b/puppet/zulip_ops/manifests/ksplice_uptrack.pp
index ea53fac6ba..b543baa37c 100644
--- a/puppet/zulip_ops/manifests/ksplice_uptrack.pp
+++ b/puppet/zulip_ops/manifests/ksplice_uptrack.pp
@@ -14,7 +14,7 @@ class zulip_ops::ksplice_uptrack {
       mode    => '0640',
       content => template('zulip_ops/uptrack/uptrack.conf.erb'),
     }
-    $setup_apt_repo_file = "${::zulip_scripts_path}/lib/setup-apt-repo"
+    $setup_apt_repo_file = "${facts['zulip_scripts_path']}/lib/setup-apt-repo"
     exec{ 'setup-apt-repo-ksplice':
       command => "${setup_apt_repo_file} --list ksplice",
       unless  => "${setup_apt_repo_file} --list ksplice --verify",
diff --git a/puppet/zulip_ops/manifests/profile/base.pp b/puppet/zulip_ops/manifests/profile/base.pp
index 184f245a17..2eb1a91017 100644
--- a/puppet/zulip_ops/manifests/profile/base.pp
+++ b/puppet/zulip_ops/manifests/profile/base.pp
@@ -51,7 +51,7 @@ class zulip_ops::profile::base {
     mode   => '0644',
     source => 'puppet:///modules/zulip_ops/apt/apt.conf.d/50unattended-upgrades',
   }
-  if $::os['distro']['release']['major'] == '22.04' {
+  if $facts['os']['distro']['release']['major'] == '22.04' {
     file { '/etc/needrestart/conf.d/zulip.conf':
       ensure => file,
       mode   => '0644',
@@ -86,7 +86,7 @@ class zulip_ops::profile::base {
   }
 
   service { 'ssh':
-    ensure     => running,
+    ensure => running,
   }
 
   file { '/etc/ssh/sshd_config':
diff --git a/puppet/zulip_ops/manifests/profile/nagios.pp b/puppet/zulip_ops/manifests/profile/nagios.pp
index abcef192dd..4e465898c5 100644
--- a/puppet/zulip_ops/manifests/profile/nagios.pp
+++ b/puppet/zulip_ops/manifests/profile/nagios.pp
@@ -109,7 +109,7 @@ class zulip_ops::profile::nagios {
     '/etc/nagios4/conf.d/hostgroups_nagios2.cfg',
     '/etc/nagios4/conf.d/localhost_nagios2.cfg',
   ]:
-    ensure     => absent,
+    ensure => absent,
   }
 
   file { '/etc/nagios4/conf.d/zulip_nagios.cfg':
diff --git a/puppet/zulip_ops/manifests/profile/zmirror.pp b/puppet/zulip_ops/manifests/profile/zmirror.pp
index f2798087ee..584a4a67d3 100644
--- a/puppet/zulip_ops/manifests/profile/zmirror.pp
+++ b/puppet/zulip_ops/manifests/profile/zmirror.pp
@@ -12,7 +12,7 @@ class zulip_ops::profile::zmirror {
     'python3-typing-extensions',
   ]
   package { $zmirror_packages:
-    ensure  => installed,
+    ensure => installed,
   }
 
   file { "${zulip::common::supervisor_conf_dir}/zmirror.conf":
diff --git a/puppet/zulip_ops/manifests/profile/zmirror_personals.pp b/puppet/zulip_ops/manifests/profile/zmirror_personals.pp
index d65c8582ce..32eaca1fd6 100644
--- a/puppet/zulip_ops/manifests/profile/zmirror_personals.pp
+++ b/puppet/zulip_ops/manifests/profile/zmirror_personals.pp
@@ -12,7 +12,7 @@ class zulip_ops::profile::zmirror_personals {
     'python3-typing-extensions',
   ]
   package { $zmirror_packages:
-    ensure  => installed,
+    ensure => installed,
   }
 
   file { '/etc/krb5.conf':
diff --git a/puppet/zulip_ops/manifests/teleport/base.pp b/puppet/zulip_ops/manifests/teleport/base.pp
index 8c53db279f..069c8b1eea 100644
--- a/puppet/zulip_ops/manifests/teleport/base.pp
+++ b/puppet/zulip_ops/manifests/teleport/base.pp
@@ -1,7 +1,7 @@
 class zulip_ops::teleport::base {
   include zulip::supervisor
 
-  $setup_apt_repo_file = "${::zulip_scripts_path}/lib/setup-apt-repo"
+  $setup_apt_repo_file = "${facts['zulip_scripts_path']}/lib/setup-apt-repo"
   exec{ 'setup-apt-repo-teleport':
     command => "${setup_apt_repo_file} --list teleport",
     unless  => "${setup_apt_repo_file} --list teleport --verify",
diff --git a/puppet/zulip_ops/manifests/vector.pp b/puppet/zulip_ops/manifests/vector.pp
index ec97c0ead4..4a219ad7b3 100644
--- a/puppet/zulip_ops/manifests/vector.pp
+++ b/puppet/zulip_ops/manifests/vector.pp
@@ -5,7 +5,7 @@ class zulip_ops::vector {
   $dir = "/srv/zulip-vector-${version}"
   $bin = "${dir}/bin/vector"
 
-  $arch = $::os['architecture'] ? {
+  $arch = $facts['os']['architecture'] ? {
     'amd64'   => 'x86_64',
     'aarch64' => 'aarch64',
   }