diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml
index 68ba88ac..94679101 100644
--- a/.github/workflows/ansible-lint.yml
+++ b/.github/workflows/ansible-lint.yml
@@ -21,3 +21,4 @@ jobs:
           # demote var-naming[no-role-prefix] to warnings, as we only have a single role,
           # and prefixing all variables in that role with the role name is really ugly
           args: "--warn-list var-naming[no-role-prefix]"
+          requirements_file: "ansible/galaxy-requirements.yml"
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 39b06bd8..8200819f 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -62,7 +62,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
diff --git a/ansible/galaxy-requirements.yml b/ansible/galaxy-requirements.yml
new file mode 100644
index 00000000..06b90316
--- /dev/null
+++ b/ansible/galaxy-requirements.yml
@@ -0,0 +1,8 @@
+#
+# Install roles and collections from the default Ansible Galaxy server.
+#
+---
+collections:
+  - name: community.general
+    version: '>=10.7.3'
+...
diff --git a/ansible/playbooks/roles/compatibility_layer/defaults/main.yml b/ansible/playbooks/roles/compatibility_layer/defaults/main.yml
index 9c7aab84..ddd867db 100644
--- a/ansible/playbooks/roles/compatibility_layer/defaults/main.yml
+++ b/ansible/playbooks/roles/compatibility_layer/defaults/main.yml
@@ -20,9 +20,9 @@ gentoo_git_repo: https://github.com/gentoo/gentoo.git
 gentoo_git_commit: 083e38cef302128d595e9f9cfd029ad8f67ec2b7
 prefix_required_space: 15 GB
 prefix_user_defined_trusted_dirs:
-  - "/cvmfs/{{ cvmfs_repository }}/host_injections/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/override"
-  - "/cvmfs/{{ cvmfs_repository }}/host_injections/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/nvidia"
-  - "/cvmfs/{{ cvmfs_repository }}/host_injections/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/amd"
+  - "/cvmfs/{{ cvmfs_repository }}/versions/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/override"
+  - "/cvmfs/{{ cvmfs_repository }}/versions/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/nvidia"
+  - "/cvmfs/{{ cvmfs_repository }}/versions/{{ eessi_version }}/compat/{{ eessi_host_os }}/{{ eessi_host_arch }}/lib/amd"
 prefix_mask_packages: |
   # stick to GCC 13.x; using a too recent compiler in the compat layer may complicate stuff in the software layer,
   # see for example https://github.com/EESSI/software-layer/issues/151
diff --git a/ansible/playbooks/roles/compatibility_layer/handlers/main.yml b/ansible/playbooks/roles/compatibility_layer/handlers/main.yml
index 15f88ef7..078eb915 100644
--- a/ansible/playbooks/roles/compatibility_layer/handlers/main.yml
+++ b/ansible/playbooks/roles/compatibility_layer/handlers/main.yml
@@ -4,3 +4,8 @@
 - name: Generate locales
   ansible.builtin.command: locale-gen
   changed_when: true
+
+- name: Sync overlays
+  community.general.portage:
+    sync: 'yes'
+    verbose: true
diff --git a/ansible/playbooks/roles/compatibility_layer/tasks/add_overlay.yml b/ansible/playbooks/roles/compatibility_layer/tasks/add_overlay.yml
index f728896b..47a8c4d4 100644
--- a/ansible/playbooks/roles/compatibility_layer/tasks/add_overlay.yml
+++ b/ansible/playbooks/roles/compatibility_layer/tasks/add_overlay.yml
@@ -17,6 +17,7 @@
     dest: "{{ gentoo_prefix_path }}/etc/portage/repos.conf/{{ item.name }}.conf"
     mode: "0644"
   loop: "{{ custom_overlays }}"
+  notify: Sync overlays
 
 - name: Make configuration file with overlays that can override eclasses
   ansible.builtin.copy:
@@ -29,10 +30,8 @@
         selectattr('eclass-overrides', 'equalto', True) | map(attribute='name') | join(' ')
       }}
 
-- name: Sync the repositories
-  community.general.portage:
-    sync: 'yes'
-    verbose: true
+- name: Flush handlers to make sure that overlays are synced
+  ansible.builtin.meta: flush_handlers
 
 - name: Find all files and directories in the etc/portage directory of the overlay
   ansible.builtin.find: