diff --git a/Jenkinsfile b/Jenkinsfile
index 7c97d4b..d593346 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -5,7 +5,7 @@ pipeline {
         maintainer_credential_ref = 'dockerhub-tier'
         imagename = 'g'
         tag = 'l'
-        version='4.0.0'
+        version='4.0.1'
     }
     stages {
         stage('Setting build context') {
diff --git a/NOTICE b/NOTICE
index 0cf66c7..455a617 100644
--- a/NOTICE
+++ b/NOTICE
@@ -1,6 +1,6 @@
 Docker for COmanage Registry
 
-Copyright (C) 2010-2019
+Copyright (C) 2010-2022
 University Corporation for Advanced Internet Development, Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/comanage-registry-base/Dockerfile b/comanage-registry-base/Dockerfile
index 334aaca..5bc4a1c 100644
--- a/comanage-registry-base/Dockerfile
+++ b/comanage-registry-base/Dockerfile
@@ -16,7 +16,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-FROM php:7.3.31-apache-bullseye
+FROM php:7.3.33-apache-bullseye
 
 # Official PHP image with Apache HTTPD includes
 # --with-openssl
diff --git a/comanage-registry-base/README.md b/comanage-registry-base/README.md
index df8b32c..898a5eb 100644
--- a/comanage-registry-base/README.md
+++ b/comanage-registry-base/README.md
@@ -53,7 +53,7 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 export COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
 TAG="${COMANAGE_REGISTRY_VERSION}-${COMANAGE_REGISTRY_BASE_IMAGE_VERSION}"
 docker build \
diff --git a/comanage-registry-basic-auth-develop/README.md b/comanage-registry-basic-auth-develop/README.md
index 384a10a..31bfbbd 100644
--- a/comanage-registry-basic-auth-develop/README.md
+++ b/comanage-registry-basic-auth-develop/README.md
@@ -59,7 +59,7 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 export COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
 export COMANAGE_REGISTRY_BASIC_AUTH_DEVELOP_IMAGE_VERSION=1
 TAG="${COMANAGE_REGISTRY_VERSION}-basic-auth-develop-${COMANAGE_REGISTRY_BASIC_AUTH_DEVELOP_IMAGE_VERSION}" 
@@ -111,7 +111,7 @@ docker run -d \
   -v /opt/comanage-registry-local:/srv/comanage-registry/local \
   -p 80:80 \
   -p 443:443 \
-  comanage-registry:3.3.3-basic-auth-develop-1
+  comanage-registry:4.0.1-basic-auth-develop-1
 ```
 
 ## Logging
diff --git a/comanage-registry-basic-auth/README.md b/comanage-registry-basic-auth/README.md
index bb02085..1453651 100644
--- a/comanage-registry-basic-auth/README.md
+++ b/comanage-registry-basic-auth/README.md
@@ -58,7 +58,7 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 export COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
 export COMANAGE_REGISTRY_BASIC_AUTH_IMAGE_VERSION=1
 TAG="${COMANAGE_REGISTRY_VERSION}-basic-auth-${COMANAGE_REGISTRY_BASIC_AUTH_IMAGE_VERSION}" 
@@ -110,7 +110,7 @@ docker run -d \
   -v /opt/comanage-registry-local:/srv/comanage-registry/local \
   -p 80:80 \
   -p 443:443 \
-  comanage-registry:3.3.3-basic-auth-1
+  comanage-registry:4.0.1-basic-auth-1
 ```
 
 ## Logging
diff --git a/comanage-registry-cron/README.md b/comanage-registry-cron/README.md
index c82c92c..d6ec255 100644
--- a/comanage-registry-cron/README.md
+++ b/comanage-registry-cron/README.md
@@ -52,7 +52,7 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 export COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
 export COMANAGE_REGISTRY_CRON_IMAGE_VERSION=1
 TAG="${COMANAGE_REGISTRY_VERSION}-${COMANAGE_REGISTRY_CRON_IMAGE_VERSION}"
@@ -135,9 +135,16 @@ If no crontab file is found the container uses this default crontab file:
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 MAILTO=""
-# Deprecated job to run expirations, syncorgsources, and groupvalidity tasks (until Registry v4.0.0)
-0 1 * * * cd /srv/comanage-registry/app && ./Console/cake job -q
-# Run the job queue for CO 1 every 5 minutes starting at minute 0
+# Run Expiration Policies for CO 1 once a day at 1:00 AM
+0 1 * * * cd /srv/comanage-registry/app && ./Console/cake job CoreJob.Expire -s --coid 1
+
+# Run Synchronize Org Identity Sources for CO 1 once a day at 1:00 AM
+0 1 * * * cd /srv/comanage-registry/app && ./Console/cake job CoreJob.Sync -s --coid 1
+
+# Run Validate Group Member for CO 1 once a day at 1:00 AM
+0 1 * * * cd /srv/comanage-registry/app && ./Console/cake job CoreJob.ValidateGroupMember -s --coid 1
+
+# Run queued jobs for CO 1 every 5 minutes
 0-59/5 * * * * cd /srv/comanage-registry/app && ./Console/cake job -q -r -c 1
 ```
 
@@ -165,7 +172,7 @@ To run this image:
 docker run -d \
   --name comanage-registry-cron \
   -v /opt/comanage-registry-local:/srv/comanage-registry/local \
-  comanage-registry-cron:3.3.3-1
+  comanage-registry-cron:4.0.1-1
 ```
 
 ## Logging
diff --git a/comanage-registry-internet2-tier-base/Dockerfile b/comanage-registry-internet2-tier-base/Dockerfile
index 7d4e780..7c4ef32 100644
--- a/comanage-registry-internet2-tier-base/Dockerfile
+++ b/comanage-registry-internet2-tier-base/Dockerfile
@@ -25,7 +25,7 @@ RUN yum -y remove \
     postgresql-devel \
     postgresql
 
-ARG PHP_VERSION=7.3.31
+ARG PHP_VERSION=7.3.33
 ARG PHP_SRC_URL=https://github.com/php/php-src/archive/php-${PHP_VERSION}.tar.gz
 
 RUN yum -y install epel-release \
diff --git a/comanage-registry-internet2-tier-base/README.md b/comanage-registry-internet2-tier-base/README.md
index 2b1c0aa..f468874 100644
--- a/comanage-registry-internet2-tier-base/README.md
+++ b/comanage-registry-internet2-tier-base/README.md
@@ -51,7 +51,7 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_I2_BASE_IMAGE_VERSION=2
+export COMANAGE_REGISTRY_I2_BASE_IMAGE_VERSION=1
 TAG="${COMANAGE_REGISTRY_I2_BASE_IMAGE_VERSION}"
 docker build \
     -t comanage-registry-internet2-tier-base:${TAG} .
diff --git a/comanage-registry-internet2-tier/Dockerfile b/comanage-registry-internet2-tier/Dockerfile
index c354e9d..b239452 100644
--- a/comanage-registry-internet2-tier/Dockerfile
+++ b/comanage-registry-internet2-tier/Dockerfile
@@ -18,7 +18,7 @@
 # limitations under the License.
 ARG COMANAGE_REGISTRY_VERSION=develop
 ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
-ARG COMANAGE_REGISTRY_I2_BASE_IMAGE_VERSION=2
+ARG COMANAGE_REGISTRY_I2_BASE_IMAGE_VERSION=1
 
 FROM comanage-registry-base:${COMANAGE_REGISTRY_VERSION}-${COMANAGE_REGISTRY_BASE_IMAGE_VERSION} AS comanage
 
@@ -143,7 +143,7 @@ EXPOSE 80 443
 # following line (to prevent other scripts from processing it).
 #####     ENV TIER_BEACON_OPT_OUT True
 
-ENV TIER_RELEASE=210913
+ENV TIER_RELEASE=211207
 ENV TIER_MAINTAINER=tier
 
 WORKDIR /srv/comanage-registry
diff --git a/comanage-registry-internet2-tier/README.md b/comanage-registry-internet2-tier/README.md
index 5c97fb5..2bcb752 100644
--- a/comanage-registry-internet2-tier/README.md
+++ b/comanage-registry-internet2-tier/README.md
@@ -58,7 +58,7 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 export COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
 export COMANAGE_REGISTRY_I2_BASE_IMAGE_VERSION=1
 export COMANAGE_REGISTRY_I2_IMAGE_VERSION=1
@@ -134,7 +134,7 @@ docker run -d \
   -v /etc/shibboleth/my-org-metadata.xml:/etc/shibboleth/my-org-metadata.xml \
   -p 80:80 \
   -p 443:443 \
-  comanage-registry:3.3.3-internet2-tier-1
+  comanage-registry:4.0.1-internet2-tier-1
 ```
 
 ## Logging
diff --git a/comanage-registry-mod-auth-openidc/README.md b/comanage-registry-mod-auth-openidc/README.md
index 5085b29..da8bfc8 100644
--- a/comanage-registry-mod-auth-openidc/README.md
+++ b/comanage-registry-mod-auth-openidc/README.md
@@ -57,7 +57,7 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 export COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
 export COMANAGE_REGISTRY_MOD_AUTH_OPENIDC_IMAGE_VERSION=1
 TAG="${COMANAGE_REGISTRY_VERSION}-mod-auth-openidc-${COMANAGE_REGISTRY_MOD_AUTH_OPENIDC_IMAGE_VERSION}"
@@ -129,7 +129,7 @@ docker run -d \
   -v mod-auth-openidc.conf:/etc/apache2/conf-enabled/mod-auth-openidc.conf \
   -p 80:80 \
   -p 443:443 \
-  comanage-registry:3.3.3-mod-auth-openidc-1
+  comanage-registry:4.0.1-mod-auth-openidc-1
 ```
 
 ## Logging
diff --git a/comanage-registry-shibboleth-sp-base/Dockerfile b/comanage-registry-shibboleth-sp-base/Dockerfile
index b8e648d..bd50db8 100644
--- a/comanage-registry-shibboleth-sp-base/Dockerfile
+++ b/comanage-registry-shibboleth-sp-base/Dockerfile
@@ -51,11 +51,10 @@ RUN wget -O log4shib.tar.gz "${LOG4SHIB_URL}" \
       && cd .. \
       && rm -r src 
 
-ARG XERCESC_URL=https://apache.cs.utah.edu/xerces/c/3/sources/xerces-c-3.2.3.tar.gz
+ARG XERCESC_URL=https://mirrors.ocf.berkeley.edu/apache/xerces/c/3/sources/xerces-c-3.2.3.tar.gz
 
 ARG XERCESC_DIST_URLS="\
     ${XERCESC_URL} \
-    https://mirrors.ocf.berkeley.edu/apache/xerces/c/3/sources/xerces-c-3.2.3.tar.gz \
     http://www.gtlib.gatech.edu/pub/apache//xerces/c/3/sources/xerces-c-3.2.3.tar.gz \
     http://apache.mirrors.spacedump.net/xerces/c/3/sources/xerces-c-3.2.3.tar.gz \
     http://apache.mirror.serversaustralia.com.au/xerces/c/3/sources/xerces-c-3.2.3.tar.gz"
@@ -76,14 +75,14 @@ RUN for distUrl in ${XERCESC_DIST_URLS}; \
       && cd .. \
       && rm -r src 
 
-ARG XMLSECC_URL=https://apache.cs.utah.edu/santuario/c-library/xml-security-c-2.0.2.tar.gz
+ARG XMLSECC_URL=https://mirrors.ocf.berkeley.edu/apache/santuario/c-library/xml-security-c-2.0.4.tar.gz
 
 ARG XMLSECC_DIST_URLS="\
     ${XMLSECC_DIST_URLS} \
-    https://mirrors.ocf.berkeley.edu/apache/santuario/c-library/xml-security-c-2.0.2.tar.gz \
-    http://www.gtlib.gatech.edu/pub/apache/santuario/c-library/xml-security-c-2.0.2.tar.gz \
-    http://apache.mirrors.spacedump.net/santuario/c-library/xml-security-c-2.0.2.tar.gz \
-    http://apache.mirror.serversaustralia.com.au/santuario/c-library/xml-security-c-2.0.2.tar.gz" 
+    https://mirrors.ocf.berkeley.edu/apache/santuario/c-library/xml-security-c-2.0.4.tar.gz \
+    http://www.gtlib.gatech.edu/pub/apache/santuario/c-library/xml-security-c-2.0.4.tar.gz \
+    http://apache.mirrors.spacedump.net/santuario/c-library/xml-security-c-2.0.4.tar.gz \
+    http://apache.mirror.serversaustralia.com.au/santuario/c-library/xml-security-c-2.0.4.tar.gz" 
 
 RUN for distUrl in ${XMLSECC_DIST_URLS}; \
       do \
@@ -104,7 +103,7 @@ RUN for distUrl in ${XMLSECC_DIST_URLS}; \
       && cd .. \
       && rm -r src 
 
-ARG XMLTOOLING_URL=http://shibboleth.net/downloads/c++-opensaml/3.2.0/xmltooling-3.2.0.tar.gz
+ARG XMLTOOLING_URL=https://shibboleth.net/downloads/c++-opensaml/3.2.0/xmltooling-3.2.0.tar.gz
 
 RUN wget -O xmltooling.tar.gz "${XMLTOOLING_URL}" \
       && mkdir -p src \
@@ -121,7 +120,7 @@ RUN wget -O xmltooling.tar.gz "${XMLTOOLING_URL}" \
       && cd .. \
       && rm -r src 
 
-ARG OPENSAMLC_URL=http://shibboleth.net/downloads/c++-opensaml/3.2.0/opensaml-3.2.0.tar.gz
+ARG OPENSAMLC_URL=https://shibboleth.net/downloads/c++-opensaml/3.2.0/opensaml-3.2.0.tar.gz
 
 RUN wget -O opensamlc.tar.gz "${OPENSAMLC_URL}" \
       && mkdir -p src \
@@ -138,7 +137,7 @@ RUN wget -O opensamlc.tar.gz "${OPENSAMLC_URL}" \
       && cd .. \
       && rm -r src 
 
-ARG SHIBBOLETH_SP_URL=http://shibboleth.net/downloads/service-provider/3.2.3/shibboleth-sp-3.2.3.tar.gz
+ARG SHIBBOLETH_SP_URL=https://shibboleth.net/downloads/service-provider/3.3.0/shibboleth-sp-3.3.0.tar.gz
 
 RUN wget -O shibboleth-sp.tar.gz "${SHIBBOLETH_SP_URL}" \
       && mkdir -p src \
diff --git a/comanage-registry-shibboleth-sp-base/README.md b/comanage-registry-shibboleth-sp-base/README.md
index 1397897..8424e0b 100644
--- a/comanage-registry-shibboleth-sp-base/README.md
+++ b/comanage-registry-shibboleth-sp-base/README.md
@@ -57,7 +57,7 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION=3.1.0
+export COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION=3.3.0
 export COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION=1
 TAG="${COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION}-${COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION}"
 docker build \
diff --git a/comanage-registry-shibboleth-sp/Dockerfile b/comanage-registry-shibboleth-sp/Dockerfile
index 62c53e3..38cc1a6 100644
--- a/comanage-registry-shibboleth-sp/Dockerfile
+++ b/comanage-registry-shibboleth-sp/Dockerfile
@@ -18,7 +18,7 @@
 # limitations under the License.
 ARG COMANAGE_REGISTRY_VERSION=develop
 ARG COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
-ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION="3.2.3"
+ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION="3.3.0"
 ARG COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION=1
 
 FROM comanage-registry-shibboleth-sp-base:${COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION}-${COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION} AS shib-base
diff --git a/comanage-registry-shibboleth-sp/README.md b/comanage-registry-shibboleth-sp/README.md
index 3184610..fea82f5 100644
--- a/comanage-registry-shibboleth-sp/README.md
+++ b/comanage-registry-shibboleth-sp/README.md
@@ -55,9 +55,9 @@ docker build \
 ## Building Example
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 export COMANAGE_REGISTRY_BASE_IMAGE_VERSION=1
-export COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION=3.2.0
+export COMANAGE_REGISTRY_SHIBBOLETH_SP_VERSION=3.3.0
 export COMANAGE_REGISTRY_SHIBBOLETH_SP_BASE_IMAGE_VERSION=1
 export COMANAGE_REGISTRY_SHIBBOLETH_SP_IMAGE_VERSION=1
 TAG="${COMANAGE_REGISTRY_VERSION}-shibboleth-sp-${COMANAGE_REGISTRY_SHIBBOLETH_SP_IMAGE_VERSION}"
@@ -115,7 +115,7 @@ docker run -d \
   -v /etc/shibboleth/my-org-metadata.xml:/etc/shibboleth/my-org-metadata.xml \
   -p 80:80 \
   -p 443:443 \
-  comanage-registry:3.3.3-shibboleth-sp-1
+  comanage-registry:4.0.1-shibboleth-sp-1
 ```
 
 ## Logging
diff --git a/common.bash b/common.bash
index 796ef1c..eb68b6e 100644
--- a/common.bash
+++ b/common.bash
@@ -1,3 +1,3 @@
 maintainer="i2incommon"
 imagename="comanage-registry"
-COMANAGE_REGISTRY_VERSION="4.0.0"
+COMANAGE_REGISTRY_VERSION="4.0.1"
diff --git a/docs/comanage-registry-internet2-tier.md b/docs/comanage-registry-internet2-tier.md
index f12c8c1..7b9b18a 100644
--- a/docs/comanage-registry-internet2-tier.md
+++ b/docs/comanage-registry-internet2-tier.md
@@ -50,7 +50,7 @@ wiki page for the list of releases. We recommend using the latest release.
 Here is an example (but please check the wiki page for the latest release number):
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 ```
 
 * Define the shell variable `COMANAGE_REGISTRY_BASE_IMAGE_VERSION` to be the
diff --git a/docs/evaluation.md b/docs/evaluation.md
index 576a851..0d0789f 100644
--- a/docs/evaluation.md
+++ b/docs/evaluation.md
@@ -44,7 +44,7 @@ wiki page for the list of releases. We recommend using the latest release.
 Here is an example (but please check the wiki page for the latest release number):
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 ```
 
 * Build the base COmanage Registry image:
diff --git a/docs/mod-auth-openidc-mariadb.md b/docs/mod-auth-openidc-mariadb.md
index bb2f794..2ca86c8 100644
--- a/docs/mod-auth-openidc-mariadb.md
+++ b/docs/mod-auth-openidc-mariadb.md
@@ -42,7 +42,7 @@ wiki page for the list of releases. We recommend using the latest release.
 Here is an example (but please check the wiki page for the latest release number):
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 ```
 
 * Define the shell variable `COMANAGE_REGISTRY_BASE_IMAGE_VERSION` to be the
diff --git a/docs/shibboleth-sp-mariadb.md b/docs/shibboleth-sp-mariadb.md
index 87e4f39..c4aca0d 100644
--- a/docs/shibboleth-sp-mariadb.md
+++ b/docs/shibboleth-sp-mariadb.md
@@ -42,7 +42,7 @@ wiki page for the list of releases. We recommend using the latest release.
 Here is an example (but please check the wiki page for the latest release number):
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 ```
 
 * Define the shell variable `COMANAGE_REGISTRY_BASE_IMAGE_VERSION` to be the
diff --git a/docs/shibboleth-sp-postgresql.md b/docs/shibboleth-sp-postgresql.md
index 5868be7..f28cade 100644
--- a/docs/shibboleth-sp-postgresql.md
+++ b/docs/shibboleth-sp-postgresql.md
@@ -42,7 +42,7 @@ wiki page for the list of releases. We recommend using the latest release.
 Here is an example (but please check the wiki page for the latest release number):
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 ```
 
 * Define the shell variable `COMANAGE_REGISTRY_BASE_IMAGE_VERSION` to be the
diff --git a/docs/simple-development-plugin-mariadb.md b/docs/simple-development-plugin-mariadb.md
index c6ba3e0..e5ffb3e 100644
--- a/docs/simple-development-plugin-mariadb.md
+++ b/docs/simple-development-plugin-mariadb.md
@@ -48,7 +48,7 @@ wiki page for the list of releases. We recommend using the latest release.
 Here is an example (but please check the wiki page for the latest release number):
 
 ```
-export COMANAGE_REGISTRY_VERSION=3.3.3
+export COMANAGE_REGISTRY_VERSION=4.0.1
 ```
 
 ## Build necessary images
diff --git a/docs/volumes-and-data-persistence.md b/docs/volumes-and-data-persistence.md
index acee5c7..8de588a 100644
--- a/docs/volumes-and-data-persistence.md
+++ b/docs/volumes-and-data-persistence.md
@@ -50,7 +50,7 @@ docker run -d \
   -v /opt/comanage-registry-local:/srv/comanage-registry/local \
   -p 80:80 \
   -p 443:443 \
-  comanage-registry:3.3.3-shibboleth-sp-1
+  comanage-registry:4.0.1-shibboleth-sp-1
 ```
 
 After the image is instantiated into a container for the first time