diff --git a/susemanager-utils/susemanager-sls/salt/bootloader/autoinstall.sls b/susemanager-utils/susemanager-sls/salt/bootloader/autoinstall.sls
index 2066c24baa8e..57c68223ad20 100644
--- a/susemanager-utils/susemanager-sls/salt/bootloader/autoinstall.sls
+++ b/susemanager-utils/susemanager-sls/salt/bootloader/autoinstall.sls
@@ -50,7 +50,7 @@ mgr_set_default_boot:
 
 mgr_elilo_copy_config:
   cmd.run:
-    - name: elilo
+    - name: /sbin/elilo
     - onchanges:
       - file: mgr_create_elilo_entry
       - file: mgr_set_default_boot
@@ -72,7 +72,7 @@ mgr_set_default_boot:
 
 mgr_generate_grubconf:
   cmd.run:
-    - name: grub2-mkconfig -o /boot/grub2/grub.cfg
+    - name: /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg
     - onchanges:
       - file: mgr_copy_kernel
       - file: mgr_copy_initrd
@@ -82,7 +82,7 @@ mgr_generate_grubconf:
 
 mgr_autoinstall_start:
   cmd.run:
-    - name: shutdown -r +1
+    - name: /usr/sbin/shutdown -r +1
     - require:
 {% if loader_type == 'grub' %}
       - cmd: mgr_grub_boot_once
diff --git a/susemanager-utils/susemanager-sls/salt/bootstrap/init.sls b/susemanager-utils/susemanager-sls/salt/bootstrap/init.sls
index 6cdfc867262e..022b490823fc 100644
--- a/susemanager-utils/susemanager-sls/salt/bootstrap/init.sls
+++ b/susemanager-utils/susemanager-sls/salt/bootstrap/init.sls
@@ -168,7 +168,7 @@ bootstrap_repo:
 {% set salt_minion_installed = (salt['pkg.info_installed']('venv-salt-minion', attr='version', failhard=False).get('venv-salt-minion', {}).get('version') != None) %}
 check_bootstrap_dbg:
   cmd.run:
-    - name: echo "{{ salt_minion_installed }}"
+    - name: /usr/bin/echo "{{ salt_minion_installed }}"
 {% set venv_available_request = salt_minion_installed or salt['http.query'](bootstrap_repo_url + 'venv-enabled-' + grains['osarch'] + '.txt', status=True, verify_ssl=False) %}
 {# Prefer venv-salt-minion if available and not disabled #}
 {%- set use_venv_salt = salt['pillar.get']('mgr_force_venv_salt_minion') or ((salt_minion_installed or (0 < venv_available_request.get('status', 404) < 300)) and not salt['pillar.get']('mgr_avoid_venv_salt_minion')) %}
@@ -332,7 +332,7 @@ copy_transactional_conf_file_to_etc:
     - name: /etc/transactional-update.conf
     - source: /usr/etc/transactional-update.conf
     - unless:
-      - test -f /etc/transactional-update.conf
+      - /usr/bin/test -f /etc/transactional-update.conf
 
 transactional_update_set_reboot_method_systemd:
   file.keyvalue:
@@ -345,7 +345,7 @@ transactional_update_set_reboot_method_systemd:
     - require:
       - file: copy_transactional_conf_file_to_etc
     - unless:
-      - grep -P '^(?=[\s]*+[^#])[^#]*(REBOOT_METHOD=(?!auto))' /etc/transactional-update.conf
+      - /usr/bin/grep -P '^(?=[\s]*+[^#])[^#]*(REBOOT_METHOD=(?!auto))' /etc/transactional-update.conf
 
 disable_reboot_timer_transactional_minions:
   cmd.run:
diff --git a/susemanager-utils/susemanager-sls/salt/bootstrap/remove_traditional_stack.sls b/susemanager-utils/susemanager-sls/salt/bootstrap/remove_traditional_stack.sls
index 9651f279e412..0c36b46564d8 100644
--- a/susemanager-utils/susemanager-sls/salt/bootstrap/remove_traditional_stack.sls
+++ b/susemanager-utils/susemanager-sls/salt/bootstrap/remove_traditional_stack.sls
@@ -42,7 +42,7 @@ remove_traditional_stack:
 {%- if grains['os_family'] == 'Suse' %}
       - suseRegisterInfo
 {%- endif %}
-    - unless: rpm -q spacewalk-proxy-common || rpm -q spacewalk-common
+    - unless: /usr/bin/rpm -q spacewalk-proxy-common || /usr/bin/rpm -q spacewalk-common
 
 # only removing apt-transport-spacewalk above
 # causes apt-get update to 'freeze' if this
diff --git a/susemanager-utils/susemanager-sls/salt/bootstrap/set_proxy.sls b/susemanager-utils/susemanager-sls/salt/bootstrap/set_proxy.sls
index d2b81f052072..04771cc916fb 100644
--- a/susemanager-utils/susemanager-sls/salt/bootstrap/set_proxy.sls
+++ b/susemanager-utils/susemanager-sls/salt/bootstrap/set_proxy.sls
@@ -20,7 +20,7 @@
 restart:
   mgrcompat.module_run:
     - name: cmd.run_bg
-    - cmd: "sleep 2; service {{ salt_service }} restart"
+    - cmd: "/usr/bin/sleep 2; /usr/sbin/service {{ salt_service }} restart"
     - python_shell: true
 
 {% else -%}
diff --git a/susemanager-utils/susemanager-sls/salt/certs/init.sls b/susemanager-utils/susemanager-sls/salt/certs/init.sls
index f51e02a4e53a..1e86d289a9ec 100644
--- a/susemanager-utils/susemanager-sls/salt/certs/init.sls
+++ b/susemanager-utils/susemanager-sls/salt/certs/init.sls
@@ -8,4 +8,4 @@ mgr_proxy_ca_cert_symlink:
   file.symlink:
     - name: /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
     - target: /etc/pki/trust/anchors/RHN-ORG-TRUSTED-SSL-CERT
-    - onlyif: grep -Eq "^proxy.rhn_parent *= *[a-zA-Z0-9]+" /etc/rhn/rhn.conf && -e /etc/pki/trust/anchors/RHN-ORG-TRUSTED-SSL-CERT
+    - onlyif: /usr/bin/grep -Eq "^proxy.rhn_parent *= *[a-zA-Z0-9]+" /etc/rhn/rhn.conf && -e /etc/pki/trust/anchors/RHN-ORG-TRUSTED-SSL-CERT
diff --git a/susemanager-utils/susemanager-sls/salt/certs/redhat.sls b/susemanager-utils/susemanager-sls/salt/certs/redhat.sls
index 098fcbcfc64a..6f427f849816 100644
--- a/susemanager-utils/susemanager-sls/salt/certs/redhat.sls
+++ b/susemanager-utils/susemanager-sls/salt/certs/redhat.sls
@@ -3,7 +3,7 @@ enable_ca_store:
   cmd.run:
     - name: /usr/bin/update-ca-trust enable
     - runas: root
-    - unless: "/usr/bin/update-ca-trust check | grep \"PEM/JAVA Status: ENABLED\""
+    - unless: "/usr/bin/update-ca-trust check | /usr/bin/grep \"PEM/JAVA Status: ENABLED\""
 {%- endif %}
 
 mgr_ca_cert:
diff --git a/susemanager-utils/susemanager-sls/salt/channels/init.sls b/susemanager-utils/susemanager-sls/salt/channels/init.sls
index aee8fb4a4fed..1db77c8472cd 100644
--- a/susemanager-utils/susemanager-sls/salt/channels/init.sls
+++ b/susemanager-utils/susemanager-sls/salt/channels/init.sls
@@ -42,7 +42,7 @@ mgrchannels_enable_dnf_plugins:
     - pattern: plugins=.*
     - repl: plugins=1
 {#- default is '1' when option is not specififed #}
-    - onlyif: grep -e 'plugins=0' -e 'plugins=False' -e 'plugins=no' /etc/dnf/dnf.conf
+    - onlyif: /usr/bin/grep -e 'plugins=0' -e 'plugins=False' -e 'plugins=no' /etc/dnf/dnf.conf
 {%- endif %}
 
 {# this break the susemanagerplugin as it overwrite HTTP headers (bsc#1214601) #}
@@ -51,7 +51,7 @@ mgrchannels_disable_dnf_rhui_plugin:
     - name: /etc/yum/pluginconf.d/dnf_rhui_plugin.conf
     - pattern: enabled=.*
     - repl: enabled=0
-    - onlyif: grep -e 'enabled=1' -e 'enabled=True' -e 'enabled=yes' /etc/yum/pluginconf.d/dnf_rhui_plugin.conf
+    - onlyif: /usr/bin/grep -e 'enabled=1' -e 'enabled=True' -e 'enabled=yes' /etc/yum/pluginconf.d/dnf_rhui_plugin.conf
 
 {%- endif %}
 
@@ -79,7 +79,7 @@ mgrchannels_enable_yum_plugins:
     - name: /etc/yum.conf
     - pattern: plugins=.*
     - repl: plugins=1
-    - onlyif: grep plugins=0 /etc/yum.conf
+    - onlyif: /usr/bin/grep plugins=0 /etc/yum.conf
 
 {%- endif %}
 {%- endif %}
@@ -147,7 +147,7 @@ mgrchannels_dnf_clean_all:
     - runas: root
     - onchanges:
        - file: "/etc/yum.repos.d/susemanager:channels.repo"
-    -  unless: "/usr/bin/dnf repolist | grep \"repolist: 0$\""
+    -  unless: "/usr/bin/dnf repolist | /usr/bin/grep \"repolist: 0$\""
 {%- endif %}
 {%- if is_yum %}
 mgrchannels_yum_clean_all:
@@ -156,7 +156,7 @@ mgrchannels_yum_clean_all:
     - runas: root
     - onchanges: 
        - file: "/etc/yum.repos.d/susemanager:channels.repo"
-    -  unless: "/usr/bin/yum repolist | grep \"repolist: 0$\""
+    -  unless: "/usr/bin/yum repolist | /usr/bin/grep \"repolist: 0$\""
 {%- endif %}
 {%- elif grains['os_family'] == 'Debian' %}
 install_gnupg_debian:
diff --git a/susemanager-utils/susemanager-sls/salt/cleanup_minion/init.sls b/susemanager-utils/susemanager-sls/salt/cleanup_minion/init.sls
index 016b977ee53e..fc1a0b9ffc7d 100644
--- a/susemanager-utils/susemanager-sls/salt/cleanup_minion/init.sls
+++ b/susemanager-utils/susemanager-sls/salt/cleanup_minion/init.sls
@@ -60,7 +60,7 @@ mgr_remove_salt_master_key:
 {%- if salt['pillar.get']('contact_method') not in ['ssh-push', 'ssh-push-tunnel'] %}
 mgr_disable_salt:
   cmd.run:
-    - name: systemctl disable {{ salt_minion_name }}
+    - name: /usr/bin/systemctl disable {{ salt_minion_name }}
     - require:
       - file: mgr_remove_salt_config
 
@@ -68,7 +68,7 @@ mgr_disable_salt:
 mgr_stop_salt:
   cmd.run:
     - bg: True
-    - name: sleep 9 && systemctl stop {{ salt_minion_name }}
+    - name: /usr/bin/sleep 9 && /usr/bin/systemctl stop {{ salt_minion_name }}
     - order: last
     - require:
       - file: mgr_remove_salt_config
diff --git a/susemanager-utils/susemanager-sls/salt/cocoattest/requestdata.sls b/susemanager-utils/susemanager-sls/salt/cocoattest/requestdata.sls
index f261ee7540ee..edfc9e8c40a4 100644
--- a/susemanager-utils/susemanager-sls/salt/cocoattest/requestdata.sls
+++ b/susemanager-utils/susemanager-sls/salt/cocoattest/requestdata.sls
@@ -18,28 +18,28 @@ mgr_inst_snpguest:
 
 mgr_write_request_data:
   cmd.run:
-    - name: echo "{{ salt['pillar.get']('attestation_data:nonce') }}" | base64 -d > /tmp/cocoattest/request-data.txt
-    - onlyif: test -x /usr/bin/base64
+    - name: /usr/bin/echo "{{ salt['pillar.get']('attestation_data:nonce') }}" | /usr/bin/base64 -d > /tmp/cocoattest/request-data.txt
+    - onlyif: /usr/bin/test -x /usr/bin/base64
     - require:
       - file: mgr_create_attestdir
 
 mgr_create_snpguest_report:
   cmd.run:
-    - name: snpguest report /tmp/cocoattest/report.bin /tmp/cocoattest/request-data.txt
+    - name: /usr/bin/snpguest report /tmp/cocoattest/report.bin /tmp/cocoattest/request-data.txt
     - require:
       - cmd: mgr_write_request_data
       - file: mgr_create_attestdir
 
 mgr_snpguest_report:
   cmd.run:
-    - name: cat /tmp/cocoattest/report.bin | base64
+    - name: /usr/bin/cat /tmp/cocoattest/report.bin | /usr/bin/base64
     - require:
       - cmd: mgr_create_snpguest_report
       - file: mgr_create_attestdir
 
 mgr_secureboot_enabled:
   cmd.run:
-    - name: mokutil --sb-state
+    - name: /usr/bin/mokutil --sb-state
     - success_retcodes:
       - 255
       - 0
diff --git a/susemanager-utils/susemanager-sls/salt/hardware/profileupdate.sls b/susemanager-utils/susemanager-sls/salt/hardware/profileupdate.sls
index f7638cf68aee..cab16f14d93a 100644
--- a/susemanager-utils/susemanager-sls/salt/hardware/profileupdate.sls
+++ b/susemanager-utils/susemanager-sls/salt/hardware/profileupdate.sls
@@ -154,7 +154,7 @@ dns_fqdns:
       - mgrcompat: sync_states
 {%- endif %}
     - onlyif:
-        which host || which nslookup
+        /usr/bin/which host || /usr/bin/which nslookup
 {% endif%}
 {% if 'network.fqdns' in salt %}
 fqdns:
diff --git a/susemanager-utils/susemanager-sls/salt/images/kiwi-image-build.sls b/susemanager-utils/susemanager-sls/salt/images/kiwi-image-build.sls
index c2320b4437ca..765d3c235c12 100644
--- a/susemanager-utils/susemanager-sls/salt/images/kiwi-image-build.sls
+++ b/susemanager-utils/susemanager-sls/salt/images/kiwi-image-build.sls
@@ -42,7 +42,7 @@ mgr_buildimage_prepare_activation_key_in_source:
 {%- if use_kiwi_ng %}
 # KIWI NG
 #
-{%- set kiwi = 'kiwi-ng' %}
+{%- set kiwi = '/usr/bin/kiwi-ng' %}
 
 {%- set kiwi_options = pillar.get('kiwi_options', '') %}
 {%- set bootstrap_packages = ['findutils', 'rhn-org-trusted-ssl-cert-osimage'] %}
@@ -91,7 +91,7 @@ mgr_buildimage_kiwi_bundle:
 
 # i586 build on x86_64 host must be called with linux32
 # let's consider the build i586 if there is no x86_64 repo specified
-{%- set kiwi = 'linux32 kiwi' if (pillar.get('kiwi_repositories')|join(' ')).find('x86_64') == -1 and grains.get('osarch') == 'x86_64' else 'kiwi' %}
+{%- set kiwi = '/usr/bin/linux32 /usr/bin/kiwi' if (pillar.get('kiwi_repositories')|join(' ')).find('x86_64') == -1 and grains.get('osarch') == 'x86_64' else '/usr/bin/kiwi' %}
 
 # in SLES11 Kiwi the --add-repotype is required
 {%- macro kiwi_params() -%}
diff --git a/susemanager-utils/susemanager-sls/salt/images/kiwi-image-inspect.sls b/susemanager-utils/susemanager-sls/salt/images/kiwi-image-inspect.sls
index 5bb3d07d97f7..4734a3abe5a8 100644
--- a/susemanager-utils/susemanager-sls/salt/images/kiwi-image-inspect.sls
+++ b/susemanager-utils/susemanager-sls/salt/images/kiwi-image-inspect.sls
@@ -20,6 +20,6 @@ mgr_inspect_kiwi_image:
 
 mgr_kiwi_cleanup:
   cmd.run:
-    - name: "rm -rf '{{ root_dir }}'"
+    - name: "/usr/bin/rm -rf '{{ root_dir }}'"
     - require:
       - mgrcompat: mgr_inspect_kiwi_image
diff --git a/susemanager-utils/susemanager-sls/salt/images/profileupdate.sls b/susemanager-utils/susemanager-sls/salt/images/profileupdate.sls
index 72fedb2e6a52..3a73136dd10a 100644
--- a/susemanager-utils/susemanager-sls/salt/images/profileupdate.sls
+++ b/susemanager-utils/susemanager-sls/salt/images/profileupdate.sls
@@ -32,7 +32,7 @@ mgr_container_remove:
     - args: [ "{{ container_name }}" ]
     - force: False
     - onlyif:
-      - docker ps -a | grep "{{ container_name }}" >/dev/null
+      - /usr/bin/docker ps -a | /usr/bin/grep "{{ container_name }}" >/dev/null
 
 mgr_image_remove:
   mgrcompat.module_run:
@@ -85,7 +85,7 @@ mgr_container_remove:
     - args: [ "{{ container_name }}" ]
     - force: False
     - onlyif:
-      - docker ps -a | grep "{{ container_name }}" >/dev/null
+      - /usr/bin/docker ps -a | /usr/bin/grep "{{ container_name }}" >/dev/null
 
 mgr_image_remove:
   mgrcompat.module_run:
diff --git a/susemanager-utils/susemanager-sls/salt/packages/profileupdate.sls b/susemanager-utils/susemanager-sls/salt/packages/profileupdate.sls
index e65b1e37f6de..a8a6e4c50f49 100644
--- a/susemanager-utils/susemanager-sls/salt/packages/profileupdate.sls
+++ b/susemanager-utils/susemanager-sls/salt/packages/profileupdate.sls
@@ -24,8 +24,8 @@ modules:
 {% elif grains['os_family'] == 'Debian' %}
 debianrelease:
   cmd.run:
-    - name: cat /etc/os-release
-    - onlyif: test -f /etc/os-release
+    - name: /usr/bin/cat /etc/os-release
+    - onlyif: /usr/bin/test -f /etc/os-release
 {% endif %}
 
 include:
diff --git a/susemanager-utils/susemanager-sls/salt/packages/redhatproductinfo.sls b/susemanager-utils/susemanager-sls/salt/packages/redhatproductinfo.sls
index ab407823c4ac..2c9f6404164f 100644
--- a/susemanager-utils/susemanager-sls/salt/packages/redhatproductinfo.sls
+++ b/susemanager-utils/susemanager-sls/salt/packages/redhatproductinfo.sls
@@ -1,38 +1,38 @@
 {% if grains['os_family'] == 'RedHat' %}
 rhelrelease:
   cmd.run:
-    - name: cat /etc/redhat-release
-    - onlyif: test -f /etc/redhat-release -a ! -L /etc/redhat-release
+    - name: /usr/bin/cat /etc/redhat-release
+    - onlyif: /usr/bin/test -f /etc/redhat-release -a ! -L /etc/redhat-release
 alibabarelease:
   cmd.run:
-    - name: cat /etc/alinux-release
-    - onlyif: test -f /etc/alinux-release
+    - name: /usr/bin/cat /etc/alinux-release
+    - onlyif: /usr/bin/test -f /etc/alinux-release
 centosrelease:
   cmd.run:
-    - name: cat /etc/centos-release
-    - onlyif: test -f /etc/centos-release
+    - name: /usr/bin/cat /etc/centos-release
+    - onlyif: /usr/bin/test -f /etc/centos-release
 oraclerelease:
   cmd.run:
-    - name: cat /etc/oracle-release
-    - onlyif: test -f /etc/oracle-release
+    - name: /usr/bin/cat /etc/oracle-release
+    - onlyif: /usr/bin/test -f /etc/oracle-release
 amazonrelease:
   cmd.run:
-    - name: cat /etc/system-release
-    - onlyif: test -f /etc/system-release && grep -qi Amazon /etc/system-release
+    - name: /usr/bin/cat /etc/system-release
+    - onlyif: /usr/bin/test -f /etc/system-release && /usr/bin/grep -qi Amazon /etc/system-release
 almarelease:
   cmd.run:
-    - name: cat /etc/almalinux-release
-    - onlyif: test -f /etc/almalinux-release
+    - name: /usr/bin/cat /etc/almalinux-release
+    - onlyif: /usr/bin/test -f /etc/almalinux-release
 rockyrelease:
   cmd.run:
-    - name: cat /etc/rocky-release
-    - onlyif: test -f /etc/rocky-release    
+    - name: /usr/bin/cat /etc/rocky-release
+    - onlyif: /usr/bin/test -f /etc/rocky-release
 respkgquery:
   cmd.run:
-    - name: rpm -q --whatprovides 'sles_es-release-server'
-    - onlyif: rpm -q --whatprovides 'sles_es-release-server'
+    - name: /usr/bin/rpm -q --whatprovides 'sles_es-release-server'
+    - onlyif: /usr/bin/rpm -q --whatprovides 'sles_es-release-server'
 sllpkgquery:
   cmd.run:
-    - name: rpm -q --whatprovides 'sll-release'
-    - onlyif: rpm -q --whatprovides 'sll-release'
+    - name: /usr/bin/rpm -q --whatprovides 'sll-release'
+    - onlyif: /usr/bin/rpm -q --whatprovides 'sll-release'
 {% endif %}
diff --git a/susemanager-utils/susemanager-sls/salt/reboot.sls b/susemanager-utils/susemanager-sls/salt/reboot.sls
index 269f68616b3d..70861535d529 100644
--- a/susemanager-utils/susemanager-sls/salt/reboot.sls
+++ b/susemanager-utils/susemanager-sls/salt/reboot.sls
@@ -1,3 +1,3 @@
 mgr_reboot:
   cmd.run:
-    - name: shutdown -r +5
+    - name: /usr/sbin/shutdown -r +5
diff --git a/susemanager-utils/susemanager-sls/salt/rebootifneeded.sls b/susemanager-utils/susemanager-sls/salt/rebootifneeded.sls
index dca67c7b399d..05f3adae45e4 100644
--- a/susemanager-utils/susemanager-sls/salt/rebootifneeded.sls
+++ b/susemanager-utils/susemanager-sls/salt/rebootifneeded.sls
@@ -1,18 +1,18 @@
 {%- if salt['pillar.get']('mgr_reboot_if_needed', True) and salt['pillar.get']('custom_info:mgr_reboot_if_needed', 'true')|lower in ('true', '1', 'yes', 't') %}
 mgr_reboot_if_needed:
   cmd.run:
-    - name: shutdown -r +5
+    - name: /usr/sbin/shutdown -r +5
 {%- if grains['os_family'] == 'RedHat' and grains['osmajorrelease'] >= 8 %}
-    - onlyif: 'dnf -q needs-restarting -r; [ $? -eq 1 ]'
+    - onlyif: '/usr/bin/dnf -q needs-restarting -r; /usr/bin/test $? -eq 1'
 {%- elif grains['os_family'] == 'RedHat' and grains['osmajorrelease'] >= 7 %}
-    - onlyif: 'needs-restarting -r; [ $? -eq 1 ]'
+    - onlyif: '/usr/bin/needs-restarting -r; /usr/bin/test $? -eq 1'
 {%- elif grains['os_family'] == 'Debian' %}
     - onlyif:
-      - test -e /var/run/reboot-required
+      - /usr/bin/test -e /var/run/reboot-required
 {%- elif grains['os_family'] == 'Suse' and grains['osmajorrelease'] <= 12 %}
     - onlyif:
-      - test -e /boot/do_purge_kernels
+      - /usr/bin/test -e /boot/do_purge_kernels
 {%- else %}
-    - onlyif: 'zypper ps -s; [ $? -eq 102 ] || [ {{ patch_need_reboot }} -eq 0 ]'
+    - onlyif: '/usr/bin/zypper ps -s; /usr/bin/test $? -eq 102 || /usr/bin/test {{ patch_need_reboot }} -eq 0 '
 {%- endif %}
 {%- endif %}
diff --git a/susemanager-utils/susemanager-sls/salt/services/salt-minion.sls b/susemanager-utils/susemanager-sls/salt/services/salt-minion.sls
index bfb117b5444b..aeefeae8210b 100644
--- a/susemanager-utils/susemanager-sls/salt/services/salt-minion.sls
+++ b/susemanager-utils/susemanager-sls/salt/services/salt-minion.sls
@@ -28,7 +28,7 @@ mgr_salt_minion_inst:
 rm_old_venv_python_env:
   cmd.run:
     - name: /usr/lib/venv-salt-minion/bin/post_start_cleanup.sh
-    - onlyif: test -f /usr/lib/venv-salt-minion/bin/post_start_cleanup.sh
+    - onlyif: /usr/bin/test -f /usr/lib/venv-salt-minion/bin/post_start_cleanup.sh
 {%- endif %}
 
 mgr_salt_minion_run:
diff --git a/susemanager-utils/susemanager-sls/salt/srvmonitoring/disable.sls b/susemanager-utils/susemanager-sls/salt/srvmonitoring/disable.sls
index 67a8cb37cf25..cbcf5ded70be 100644
--- a/susemanager-utils/susemanager-sls/salt/srvmonitoring/disable.sls
+++ b/susemanager-utils/susemanager-sls/salt/srvmonitoring/disable.sls
@@ -28,8 +28,8 @@ jmx_taskomatic_config:
 
 mgr_enable_prometheus_self_monitoring:
   cmd.run:
-    - name: grep -q '^prometheus_monitoring_enabled.*=.*' /etc/rhn/rhn.conf && sed -i 's/^prometheus_monitoring_enabled.*/prometheus_monitoring_enabled = 0/' /etc/rhn/rhn.conf || echo 'prometheus_monitoring_enabled = 0' >> /etc/rhn/rhn.conf
+    - name: /usr/bin/grep -q '^prometheus_monitoring_enabled.*=.*' /etc/rhn/rhn.conf && /usr/bin/sed -i 's/^prometheus_monitoring_enabled.*/prometheus_monitoring_enabled = 0/' /etc/rhn/rhn.conf || /usr/bin/echo 'prometheus_monitoring_enabled = 0' >> /etc/rhn/rhn.conf
 
 mgr_is_prometheus_self_monitoring_disabled:
   cmd.run:
-    - name: grep -qF 'prometheus_monitoring_enabled = 0' /etc/rhn/rhn.conf
+    - name: /usr/bin/grep -qF 'prometheus_monitoring_enabled = 0' /etc/rhn/rhn.conf
diff --git a/susemanager-utils/susemanager-sls/salt/srvmonitoring/enable.sls b/susemanager-utils/susemanager-sls/salt/srvmonitoring/enable.sls
index f6e5fbb1350d..2c9579edc687 100644
--- a/susemanager-utils/susemanager-sls/salt/srvmonitoring/enable.sls
+++ b/susemanager-utils/susemanager-sls/salt/srvmonitoring/enable.sls
@@ -139,8 +139,8 @@ jmx_exporter_taskomatic_service_cleanup:
 
 mgr_enable_prometheus_self_monitoring:
   cmd.run:
-    - name: grep -q '^prometheus_monitoring_enabled.*=.*' /etc/rhn/rhn.conf && sed -i 's/^prometheus_monitoring_enabled.*/prometheus_monitoring_enabled = 1/' /etc/rhn/rhn.conf || echo 'prometheus_monitoring_enabled = 1' >> /etc/rhn/rhn.conf
+    - name:  /usr/bin/grep -q '^prometheus_monitoring_enabled.*=.*' /etc/rhn/rhn.conf && /usr/bin/sed -i 's/^prometheus_monitoring_enabled.*/prometheus_monitoring_enabled = 1/' /etc/rhn/rhn.conf || /usr/bin/echo 'prometheus_monitoring_enabled = 1' >> /etc/rhn/rhn.conf
 
 mgr_is_prometheus_self_monitoring_enabled:
   cmd.run:
-    - name: grep -qF 'prometheus_monitoring_enabled = 1' /etc/rhn/rhn.conf
+    - name: /usr/bin/grep -qF 'prometheus_monitoring_enabled = 1' /etc/rhn/rhn.conf
diff --git a/susemanager-utils/susemanager-sls/salt/srvmonitoring/removejmxprops.sls b/susemanager-utils/susemanager-sls/salt/srvmonitoring/removejmxprops.sls
index 6948281ada28..f98efc24cf7c 100644
--- a/susemanager-utils/susemanager-sls/salt/srvmonitoring/removejmxprops.sls
+++ b/susemanager-utils/susemanager-sls/salt/srvmonitoring/removejmxprops.sls
@@ -1,24 +1,24 @@
 remove_{{remove_jmx_props.service}}_jmx_host:
   cmd.run:
-    - name: sed -ri 's/JAVA_OPTS="(.*)-Dcom\.sun\.management\.jmxremote\.host=\S*(.*)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
-    - onlyif: grep -F -- '-Dcom.sun.management.jmxremote.host=' {{remove_jmx_props.file}}
+    - name: /usr/bin/sed -ri 's/JAVA_OPTS="(.*)-Dcom\.sun\.management\.jmxremote\.host=\S*(.*)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
+    - onlyif: /usr/bin/grep -F -- '-Dcom.sun.management.jmxremote.host=' {{remove_jmx_props.file}}
 
 remove_{{remove_jmx_props.service}}_jmx_port:
   cmd.run:
-    - name: sed -ri 's/JAVA_OPTS="(.*)-Dcom\.sun\.management\.jmxremote\.port=[0-9]*(.*)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
-    - onlyif: grep -E -- '-Dcom\.sun\.management\.jmxremote\.port=[0-9]+' {{remove_jmx_props.file}}
+    - name: /usr/bin/sed -ri 's/JAVA_OPTS="(.*)-Dcom\.sun\.management\.jmxremote\.port=[0-9]*(.*)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
+    - onlyif: /usr/bin/grep -E -- '-Dcom\.sun\.management\.jmxremote\.port=[0-9]+' {{remove_jmx_props.file}}
 
 remove_{{remove_jmx_props.service}}_jmx_ssl:
   cmd.run:
-    - name: sed -i 's/JAVA_OPTS="\(.*\)-Dcom\.sun\.management\.jmxremote\.ssl=false\(.*\)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
-    - onlyif: grep -F -- '-Dcom.sun.management.jmxremote.ssl=false' {{remove_jmx_props.file}}
+    - name: /usr/bin/sed -i 's/JAVA_OPTS="\(.*\)-Dcom\.sun\.management\.jmxremote\.ssl=false\(.*\)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
+    - onlyif: /usr/bin/grep -F -- '-Dcom.sun.management.jmxremote.ssl=false' {{remove_jmx_props.file}}
 
 remove_{{remove_jmx_props.service}}_jmx_auth:
   cmd.run:
-    - name: sed -i 's/JAVA_OPTS="\(.*\)-Dcom\.sun\.management\.jmxremote\.authenticate=false\(.*\)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
-    - onlyif: grep -F -- '-Dcom.sun.management.jmxremote.authenticate=false' {{remove_jmx_props.file}}
+    - name: /usr/bin/sed -i 's/JAVA_OPTS="\(.*\)-Dcom\.sun\.management\.jmxremote\.authenticate=false\(.*\)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
+    - onlyif: /usr/bin/grep -F -- '-Dcom.sun.management.jmxremote.authenticate=false' {{remove_jmx_props.file}}
 
 remove_{{remove_jmx_props.service}}_jmx_hostname:
   cmd.run:
-    - name: sed -ri 's/JAVA_OPTS="(.*)-Djava\.rmi\.server\.hostname=\S*(.*)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
-    - onlyif: grep -F -- '-Djava.rmi.server.hostname=' {{remove_jmx_props.file}}
+    - name: /usr/bin/sed -ri 's/JAVA_OPTS="(.*)-Djava\.rmi\.server\.hostname=\S*(.*)"/JAVA_OPTS="\1 \2"/' {{remove_jmx_props.file}}
+    - onlyif: /usr/bin/grep -F -- '-Djava.rmi.server.hostname=' {{remove_jmx_props.file}}
diff --git a/susemanager-utils/susemanager-sls/salt/srvmonitoring/status.sls b/susemanager-utils/susemanager-sls/salt/srvmonitoring/status.sls
index 5362dfcbbef5..00a1acb80d6f 100644
--- a/susemanager-utils/susemanager-sls/salt/srvmonitoring/status.sls
+++ b/susemanager-utils/susemanager-sls/salt/srvmonitoring/status.sls
@@ -22,7 +22,7 @@ jmx_taskomatic_java_config:
 
 mgr_is_prometheus_self_monitoring_enabled:
   cmd.run:
-    - name: grep -q -E 'prometheus_monitoring_enabled\s*=\s*(1|y|true|yes|on)\s*$' /etc/rhn/rhn.conf
+    - name: /usr/bin/grep -q -E 'prometheus_monitoring_enabled\s*=\s*(1|y|true|yes|on)\s*$' /etc/rhn/rhn.conf
 
 include:
   - util.syncstates
diff --git a/susemanager-utils/susemanager-sls/salt/ssh_bootstrap/init.sls b/susemanager-utils/susemanager-sls/salt/ssh_bootstrap/init.sls
index 6112cce7a6dd..873c09ef0f8a 100644
--- a/susemanager-utils/susemanager-sls/salt/ssh_bootstrap/init.sls
+++ b/susemanager-utils/susemanager-sls/salt/ssh_bootstrap/init.sls
@@ -37,7 +37,7 @@ proxy_ssh_identity:
 
 generate_own_ssh_key:
   cmd.run:
-    - name: ssh-keygen -N '' -C 'susemanager-own-ssh-push' -f {{ home }}/.ssh/mgr_own_id -t rsa -q
+    - name: /usr/bin/ssh-keygen -N '' -C 'susemanager-own-ssh-push' -f {{ home }}/.ssh/mgr_own_id -t rsa -q
     - creates: {{ home }}/.ssh/mgr_own_id.pub
 
 ownership_own_ssh_key:
diff --git a/susemanager-utils/susemanager-sls/salt/uptodate.sls b/susemanager-utils/susemanager-sls/salt/uptodate.sls
index e4a4b19dbe3f..58392554a89b 100644
--- a/susemanager-utils/susemanager-sls/salt/uptodate.sls
+++ b/susemanager-utils/susemanager-sls/salt/uptodate.sls
@@ -4,17 +4,17 @@ include:
 {%- if grains['os_family'] == 'Suse' %}
 mgr_keep_system_up2date_updatestack:
   cmd.run:
-    - name: zypper --non-interactive patch --updatestack-only
+    - name: /usr/bin/zypper --non-interactive patch --updatestack-only
     - success_retcodes:
       - 104
       - 103
       - 106
       - 0
-    - onlyif: 'zypper patch-check --updatestack-only; r=$?; test $r -eq 100 || test $r -eq 101'
+    - onlyif: '/usr/bin/zypper patch-check --updatestack-only; r=$?; /usr/bin/test $r -eq 100 || /usr/bin/test $r -eq 101'
     - require:
       - sls: channels
 
-{% set patch_need_reboot = salt['cmd.retcode']('zypper -x list-patches | grep \'restart="true"\' > /dev/null', python_shell=True) %}
+{% set patch_need_reboot = salt['cmd.retcode']('/usr/bin/zypper -x list-patches | /usr/bin/grep \'restart="true"\' > /dev/null', python_shell=True) %}
 
 {% else %}
 
diff --git a/susemanager-utils/susemanager-sls/salt/util/mgr_disable_fqdns_grain.sls b/susemanager-utils/susemanager-sls/salt/util/mgr_disable_fqdns_grain.sls
index b2b17e65c9d8..6d93f3f36ba8 100644
--- a/susemanager-utils/susemanager-sls/salt/util/mgr_disable_fqdns_grain.sls
+++ b/susemanager-utils/susemanager-sls/salt/util/mgr_disable_fqdns_grain.sls
@@ -9,7 +9,7 @@ mgr_disable_fqdns_grains:
   file.append:
     - name: {{ susemanager_minion_config }}
     - text: "enable_fqdns_grains: False"
-    - unless: grep 'enable_fqdns_grains:' {{ susemanager_minion_config }}
+    - unless: /usr/bin/grep 'enable_fqdns_grains:' {{ susemanager_minion_config }}
 
 mgr_salt_minion:
   service.running:
diff --git a/susemanager-utils/susemanager-sls/salt/util/mgr_mine_config_clean_up.sls b/susemanager-utils/susemanager-sls/salt/util/mgr_mine_config_clean_up.sls
index 121f83174e46..9e92aa7134b8 100644
--- a/susemanager-utils/susemanager-sls/salt/util/mgr_mine_config_clean_up.sls
+++ b/susemanager-utils/susemanager-sls/salt/util/mgr_mine_config_clean_up.sls
@@ -10,7 +10,7 @@ mgr_disable_mine:
   file.managed:
     - name: {{ susemanager_minion_config }}
     - contents: "mine_enabled: False"
-    - unless: grep 'mine_enabled:' {{ susemanager_minion_config }}
+    - unless: /usr/bin/grep 'mine_enabled:' {{ susemanager_minion_config }}
 
 mgr_salt_minion:
   service.running:
diff --git a/susemanager-utils/susemanager-sls/salt/util/mgr_rotate_saltssh_key.sls b/susemanager-utils/susemanager-sls/salt/util/mgr_rotate_saltssh_key.sls
index da4ca57b68a9..c8bf9bcc9f17 100644
--- a/susemanager-utils/susemanager-sls/salt/util/mgr_rotate_saltssh_key.sls
+++ b/susemanager-utils/susemanager-sls/salt/util/mgr_rotate_saltssh_key.sls
@@ -12,7 +12,7 @@ proxy_new_mgr_ssh_identity:
   ssh_auth.present:
     - user: mgrsshtunnel
     - source: salt://salt_ssh/new_mgr_ssh_id.pub
-    - onlyif: grep -q mgrsshtunnel /etc/passwd
+    - onlyif: /usr/bin/grep -q mgrsshtunnel /etc/passwd
 {% endif %}
 
 {% if salt['cp.list_master'](prefix='salt_ssh/disabled_mgr_ssh_id.pub') %}
@@ -33,12 +33,12 @@ proxy_old_mgr_ssh_identity:
   ssh_auth.absent:
     - user: mgrsshtunnel
     - source: salt://salt_ssh/disabled_mgr_ssh_id.pub
-    - onlyif: grep -q mgrsshtunnel /etc/passwd
+    - onlyif: /usr/bin/grep -q mgrsshtunnel /etc/passwd
 
 # to prevent to lock out yourself
 proxy_current_mgr_ssh_identity:
   ssh_auth.present:
     - user: mgrsshtunnel
     - source: salt://salt_ssh/mgr_ssh_id.pub
-    - onlyif: grep -q mgrsshtunnel /etc/passwd
+    - onlyif: /usr/bin/grep -q mgrsshtunnel /etc/passwd
 {% endif %}
diff --git a/susemanager-utils/susemanager-sls/salt/util/mgr_start_event_grains.sls b/susemanager-utils/susemanager-sls/salt/util/mgr_start_event_grains.sls
index 0314fc82b28a..2d1faba4e22c 100644
--- a/susemanager-utils/susemanager-sls/salt/util/mgr_start_event_grains.sls
+++ b/susemanager-utils/susemanager-sls/salt/util/mgr_start_event_grains.sls
@@ -8,4 +8,4 @@ mgr_start_event_grains:
     - name: {{ susemanager_minion_config }}
     - text: |
         start_event_grains: [machine_id, saltboot_initrd, susemanager]
-    - unless: grep 'start_event_grains:' {{ susemanager_minion_config }}
+    - unless: /usr/bin/grep 'start_event_grains:' {{ susemanager_minion_config }}
diff --git a/susemanager-utils/susemanager-sls/salt/util/mgr_switch_to_venv_minion.sls b/susemanager-utils/susemanager-sls/salt/util/mgr_switch_to_venv_minion.sls
index b241bed1671f..5c889a0a8962 100644
--- a/susemanager-utils/susemanager-sls/salt/util/mgr_switch_to_venv_minion.sls
+++ b/susemanager-utils/susemanager-sls/salt/util/mgr_switch_to_venv_minion.sls
@@ -27,11 +27,11 @@ mgr_copy_salt_minion_id:
     - require:
       - pkg: mgr_venv_salt_minion_pkg
     - onlyif:
-      - test -f /etc/salt/minion_id
+      - /usr/bin/test -f /etc/salt/minion_id
 
 mgr_copy_salt_minion_configs:
   cmd.run:
-    - name: cp -r /etc/salt/minion.d /etc/venv-salt-minion/
+    - name: /usr/bin/cp -r /etc/salt/minion.d /etc/venv-salt-minion/
     - require:
       - pkg: mgr_venv_salt_minion_pkg
     - onlyif:
@@ -44,17 +44,17 @@ mgr_copy_salt_minion_grains:
     - require:
       - pkg: mgr_venv_salt_minion_pkg
     - onlyif:
-      - test -f /etc/salt/grains
+      - /usr/bin/test -f /etc/salt/grains
 
 mgr_copy_salt_minion_keys:
   cmd.run:
-    - name: cp -r /etc/salt/pki/minion/minion* /etc/venv-salt-minion/pki/minion/
+    - name: /usr/bin/cp -r /etc/salt/pki/minion/minion* /etc/venv-salt-minion/pki/minion/
     - require:
       - cmd: mgr_copy_salt_minion_configs
     - onlyif:
-      - test -f /etc/salt/pki/minion/minion_master.pub
+      - /usr/bin/test -f /etc/salt/pki/minion/minion_master.pub
     - unless:
-      - test -f /etc/venv-salt-minion/pki/minion/minion_master.pub
+      - /usr/bin/test -f /etc/venv-salt-minion/pki/minion/minion_master.pub
 
 mgr_enable_venv_salt_minion:
   service.running:
@@ -87,9 +87,9 @@ mgr_purge_non_venv_salt_packages:
 {%- if salt['pillar.get']('mgr_purge_non_venv_salt_files') %}
 mgr_purge_non_venv_salt_pki_dir:
   cmd.run:
-    - name: rm -rf /etc/salt/minion* /etc/salt/pki/minion
+    - name: /usr/bin/rm -rf /etc/salt/minion* /etc/salt/pki/minion
     - onlyif:
-      - test -d /etc/salt/pki/minion
+      - /usr/bin/test -d /etc/salt/pki/minion
     - require:
       - service: mgr_disable_salt_minion
 
@@ -97,7 +97,7 @@ mgr_purge_non_venv_salt_conf_dir:
   file.absent:
     - name: /etc/salt
     - unless:
-      - find /etc/salt -type f -print -quit | grep -q .
+      - /usr/bin/find /etc/salt -type f -print -quit | /usr/bin/grep -q .
     - require:
       - cmd: mgr_purge_non_venv_salt_pki_dir
 {%- endif %}
diff --git a/susemanager-utils/susemanager-sls/salt/virt/create-vm.sls b/susemanager-utils/susemanager-sls/salt/virt/create-vm.sls
index 24aa02523e6d..b365a2c83ba9 100644
--- a/susemanager-utils/susemanager-sls/salt/virt/create-vm.sls
+++ b/susemanager-utils/susemanager-sls/salt/virt/create-vm.sls
@@ -139,7 +139,7 @@ domain_define:
 
 {{ pillar['cluster_definitions'] }}/{{ pillar['name'] }}.xml:
   mgrutils.cmd_dump:
-    - cmd: 'virsh dumpxml --inactive {{ pillar['name'] }}'
+    - cmd: '/usr/bin/virsh dumpxml --inactive {{ pillar['name'] }}'
     - require:
       - virt: {{ "domain_define" if cdrom_boot or ks_boot else "domain_first_boot_define" }}
 
@@ -156,7 +156,7 @@ domain_define:
 
 define_primitive:
   cmd.run:
-    - name: 'crm configure load update /tmp/{{ pillar['name'] }}-primitive.conf'
+    - name: '/usr/sbin/crm configure load update /tmp/{{ pillar['name'] }}-primitive.conf'
     - require:
       - file: /tmp/{{ pillar['name'] }}-primitive.conf
 
diff --git a/susemanager-utils/susemanager-sls/susemanager-sls.changes.mackdk.avoid-executing-commands-from-PATH b/susemanager-utils/susemanager-sls/susemanager-sls.changes.mackdk.avoid-executing-commands-from-PATH
new file mode 100644
index 000000000000..6d01454e939f
--- /dev/null
+++ b/susemanager-utils/susemanager-sls/susemanager-sls.changes.mackdk.avoid-executing-commands-from-PATH
@@ -0,0 +1 @@
+- Use absolute paths when invoking external commands