diff --git a/images/macos/provision/bootstrap-provisioner/change_password b/images/macos/provision/bootstrap-provisioner/change_password
index 3235834cc..eda188471 100755
--- a/images/macos/provision/bootstrap-provisioner/change_password
+++ b/images/macos/provision/bootstrap-provisioner/change_password
@@ -4,17 +4,8 @@ OLD_PASSWD="$2"
 NEW_PASSWD="$3"
 UPDATE_LOGIN_KEYCHAIN="${4:-true}"
 
-export PATH=/usr/bin:/usr/sbin:/usr/local/bin:/bin:/sbin
-
-macosver="$(sw_vers | grep ProductVersion | awk {'print $2'})"
-
-if [[ $macosver =~ 10.13.* ]]; then
-    sudo /usr/bin/dscl . -passwd /Users/$USERNAME "$NEW_PASSWD"
-else
-    sudo /usr/sbin/sysadminctl -resetPasswordFor $USERNAME -newPassword "$NEW_PASSWD" -adminUser $USERNAME -adminPassword "$OLD_PASSWD"
-fi
-
-sudo /usr/bin/python /Users/$USERNAME/bootstrap/kcpassword.py "$NEW_PASSWD"
+sudo /usr/sbin/sysadminctl -resetPasswordFor $USERNAME -newPassword "$NEW_PASSWD" -adminUser $USERNAME -adminPassword "$OLD_PASSWD"
+sudo /usr/bin/python3 /Users/$USERNAME/bootstrap/kcpassword.py "$NEW_PASSWD"
 sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser "$USERNAME"
 
 if [[ $UPDATE_LOGIN_KEYCHAIN == "true" ]]; then
diff --git a/images/macos/provision/bootstrap-provisioner/kcpassword.py b/images/macos/provision/bootstrap-provisioner/kcpassword.py
index 6b34121e1..386d33c44 100755
--- a/images/macos/provision/bootstrap-provisioner/kcpassword.py
+++ b/images/macos/provision/bootstrap-provisioner/kcpassword.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
 # Port of Gavin Brock's Perl kcpassword generator to Python, by Tom Taylor
 # <tom@tomtaylor.co.uk>.
diff --git a/images/macos/provision/configuration/autologin.sh b/images/macos/provision/configuration/autologin.sh
index 02f2f06d9..2e962490c 100755
--- a/images/macos/provision/configuration/autologin.sh
+++ b/images/macos/provision/configuration/autologin.sh
@@ -5,7 +5,7 @@
 
 echo "Enabling automatic GUI login for the '$USERNAME' user.."
 
-python $HOME/bootstrap/kcpassword.py "$PASSWORD"
+python3 $HOME/bootstrap/kcpassword.py "$PASSWORD"
 
 /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser "$USERNAME"
 
diff --git a/images/macos/provision/configuration/configure-hostname.sh b/images/macos/provision/configuration/configure-hostname.sh
index e0de0bf8e..fef3bb2e2 100644
--- a/images/macos/provision/configuration/configure-hostname.sh
+++ b/images/macos/provision/configuration/configure-hostname.sh
@@ -4,7 +4,7 @@
 tee -a /usr/local/bin/change_hostname.sh > /dev/null <<\EOF
 #!/bin/bash -e -o pipefail
 
-name="Mac-$(python -c 'from time import time; print int(round(time() * 1000))')"
+name="Mac-$(python3 -c 'from time import time; print(int(round(time() * 1000)))')"
 scutil --set HostName "${name}.local"
 scutil --set LocalHostName $name
 scutil --set ComputerName "${name}.local"
diff --git a/images/macos/templates/macOS-10.15.json b/images/macos/templates/macOS-10.15.json
index cc67e74ce..9d051353a 100644
--- a/images/macos/templates/macOS-10.15.json
+++ b/images/macos/templates/macOS-10.15.json
@@ -92,6 +92,7 @@
             "type": "shell",
             "execute_command": "chmod +x {{ .Path }}; sudo {{ .Vars }} {{ .Path }}",
             "scripts": [
+                "./provision/core/xcode-clt.sh",
                 "./provision/configuration/add-network-interface-detection.sh",
                 "./provision/configuration/autologin.sh",
                 "./provision/configuration/disable-auto-updates.sh",
@@ -129,7 +130,6 @@
             "execute_command": "chmod +x {{ .Path }}; {{ .Vars }} {{ .Path }}",
             "pause_before": "30s",
             "scripts": [
-                "./provision/core/xcode-clt.sh",
                 "./provision/core/homebrew.sh",
                 "./provision/core/open_windows_check.sh",
                 "./provision/core/powershell.sh",
diff --git a/images/macos/templates/macOS-11.json b/images/macos/templates/macOS-11.json
index ed7b80dbe..a62b26a97 100644
--- a/images/macos/templates/macOS-11.json
+++ b/images/macos/templates/macOS-11.json
@@ -97,6 +97,7 @@
             "type": "shell",
             "execute_command": "chmod +x {{ .Path }}; sudo {{ .Vars }} {{ .Path }}",
             "scripts": [
+                "./provision/core/xcode-clt.sh",
                 "./provision/configuration/add-network-interface-detection.sh",
                 "./provision/configuration/autologin.sh",
                 "./provision/configuration/disable-auto-updates.sh",
@@ -116,7 +117,6 @@
             "scripts": [
                 "./provision/configuration/preimagedata.sh",
                 "./provision/configuration/configure-ssh.sh",
-                "./provision/core/xcode-clt.sh",
                 "./provision/configuration/configure-machine.sh"
             ],
             "environment_vars": [
diff --git a/images/macos/templates/macOS-11.pkr.hcl b/images/macos/templates/macOS-11.pkr.hcl
index 72bc9d59b..bbc65e2b6 100644
--- a/images/macos/templates/macOS-11.pkr.hcl
+++ b/images/macos/templates/macOS-11.pkr.hcl
@@ -98,6 +98,7 @@ build {
   }
   provisioner "shell" {
     scripts = [
+      "./provision/core/xcode-clt.sh",
       "./provision/configuration/configure-tccdb-macos11.sh",
       "./provision/configuration/add-network-interface-detection.sh",
       "./provision/configuration/autologin.sh",
@@ -117,7 +118,6 @@ build {
     scripts = [
       "./provision/configuration/preimagedata.sh",
       "./provision/configuration/configure-ssh.sh",
-      "./provision/core/xcode-clt.sh",
       "./provision/configuration/configure-machine.sh"
     ]
     environment_vars = [
diff --git a/images/macos/templates/macOS-12.json b/images/macos/templates/macOS-12.json
index 8c54b7c10..c9477bb6b 100644
--- a/images/macos/templates/macOS-12.json
+++ b/images/macos/templates/macOS-12.json
@@ -97,6 +97,7 @@
             "type": "shell",
             "execute_command": "chmod +x {{ .Path }}; sudo {{ .Vars }} {{ .Path }}",
             "scripts": [
+                "./provision/core/xcode-clt.sh",
                 "./provision/configuration/add-network-interface-detection.sh",
                 "./provision/configuration/autologin.sh",
                 "./provision/configuration/disable-auto-updates.sh",
@@ -116,7 +117,6 @@
             "scripts": [
                 "./provision/configuration/preimagedata.sh",
                 "./provision/configuration/configure-ssh.sh",
-                "./provision/core/xcode-clt.sh",
                 "./provision/configuration/configure-machine.sh"
             ],
             "environment_vars": [