Thanks for the idea ! I will try pyinfra first, which provides a way to connect to the fleet and then to execute a whole set of scripts. Whereas Dependabot's perimeter looks more contained on dependencies update.