diff --git a/bitnami/drupal/11/debian-12/Dockerfile b/bitnami/drupal/11/debian-12/Dockerfile
index 454f2a5b53ea..0588fb048546 100644
--- a/bitnami/drupal/11/debian-12/Dockerfile
+++ b/bitnami/drupal/11/debian-12/Dockerfile
@@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith"
 ARG TARGETARCH
 
 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-06-01T13:20:32Z" \
+      org.opencontainers.image.created="2026-06-04T14:37:40Z" \
       org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
       org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/drupal/README.md" \
       org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/drupal" \
@@ -28,7 +28,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
     DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \
     mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \
     COMPONENTS=( \
-      "render-template-1.0.9-165-linux-${OS_ARCH}-debian-12" \
+      "render-template-1.0.9-166-linux-${OS_ARCH}-debian-12" \
       "php-8.4.21-5-linux-${OS_ARCH}-debian-12" \
       "mysql-client-12.3.2-0-linux-${OS_ARCH}-debian-12" \
       "libphp-8.4.21-0-linux-${OS_ARCH}-debian-12" \
@@ -61,8 +61,8 @@ ENV APACHE_HTTPS_PORT_NUMBER="" \
     APACHE_HTTP_PORT_NUMBER="" \
     APP_VERSION="11.3.11" \
     BITNAMI_APP_NAME="drupal" \
-    IMAGE_REVISION="2" \
-    LD_LIBRARY_PATH="/opt/bitnami/postgresql/lib:$LD_LIBRARY_PATH" \
+    IMAGE_REVISION="3" \
+    LD_LIBRARY_PATH="/opt/bitnami/postgresql/lib" \
     PATH="/opt/bitnami/common/bin:/opt/bitnami/php/bin:/opt/bitnami/php/sbin:/opt/bitnami/mysql/bin:/opt/bitnami/apache/bin:/opt/bitnami/drupal/vendor/bin:$PATH"
 
 EXPOSE 8080 8443
diff --git a/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-165-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-165-linux-amd64-debian-12.tar.gz.sha256
deleted file mode 100644
index ecf216f2789c..000000000000
--- a/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-165-linux-amd64-debian-12.tar.gz.sha256
+++ /dev/null
@@ -1 +0,0 @@
-374910c7361f00d393eca79a749d29f389b4522057902c7655f0a3a5ae3d1b32  render-template-1.0.9-165-linux-amd64-debian-12.tar.gz
diff --git a/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-165-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-165-linux-arm64-debian-12.tar.gz.sha256
deleted file mode 100644
index e15b6bdd7577..000000000000
--- a/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-165-linux-arm64-debian-12.tar.gz.sha256
+++ /dev/null
@@ -1 +0,0 @@
-d492024d2d8261cfb147e7b508d341b91349fd41cf41aecd0706046be8cb108b  render-template-1.0.9-165-linux-arm64-debian-12.tar.gz
diff --git a/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-166-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-166-linux-amd64-debian-12.tar.gz.sha256
new file mode 100644
index 000000000000..09a2ab4133ea
--- /dev/null
+++ b/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-166-linux-amd64-debian-12.tar.gz.sha256
@@ -0,0 +1 @@
+e2467be27e79a387c78b8ef3a57ceaa07bea65009972571f20dcf58631656e0b  render-template-1.0.9-166-linux-amd64-debian-12.tar.gz
diff --git a/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-166-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-166-linux-arm64-debian-12.tar.gz.sha256
new file mode 100644
index 000000000000..25ae43b180a6
--- /dev/null
+++ b/bitnami/drupal/11/debian-12/prebuildfs/opt/bitnami/checksums/render-template-1.0.9-166-linux-arm64-debian-12.tar.gz.sha256
@@ -0,0 +1 @@
+c2c7634c5c0882d2dbd822744f6b5bdb074a07a1abf710c67e1206f1c20b8afa  render-template-1.0.9-166-linux-arm64-debian-12.tar.gz
diff --git a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami-ssl.conf.tpl b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami-ssl.conf.tpl
index a830382f2dd3..66d6deb84f29 100644
--- a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami-ssl.conf.tpl
+++ b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami-ssl.conf.tpl
@@ -21,7 +21,7 @@ SSLSessionCacheTimeout  300
   SSLCertificateKeyFile "{{APACHE_CONF_DIR}}/bitnami/certs/tls.key"
 
   <Directory "{{APACHE_BASE_DIR}}/htdocs">
-    Options Indexes FollowSymLinks
+    Options FollowSymLinks
     AllowOverride All
     Require all granted
   </Directory>
diff --git a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami.conf.tpl b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami.conf.tpl
index 75a255c3efee..73d73314f8a3 100644
--- a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami.conf.tpl
+++ b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/apache/bitnami-templates/bitnami.conf.tpl
@@ -6,7 +6,7 @@ SetEnvIf X-Forwarded-Proto https HTTPS=on
 <VirtualHost _default_:80>
   DocumentRoot "{{APACHE_BASE_DIR}}/htdocs"
   <Directory "{{APACHE_BASE_DIR}}/htdocs">
-    Options Indexes FollowSymLinks
+    Options FollowSymLinks
     AllowOverride All
     Require all granted
   </Directory>
diff --git a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/drupal-env.sh b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/drupal-env.sh
index 6f24caa485ad..d7a8f4f6f32f 100644
--- a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/drupal-env.sh
+++ b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/drupal-env.sh
@@ -31,6 +31,7 @@ drupal_env_vars=(
     DRUPAL_ENABLE_MODULES
     DRUPAL_CONFIG_SYNC_DIR
     DRUPAL_HASH_SALT
+    DRUPAL_TRUSTED_HOSTS
     DRUPAL_USERNAME
     DRUPAL_PASSWORD
     DRUPAL_EMAIL
@@ -84,6 +85,7 @@ export DRUPAL_SKIP_BOOTSTRAP="${DRUPAL_SKIP_BOOTSTRAP:-}" # only used during the
 export DRUPAL_ENABLE_MODULES="${DRUPAL_ENABLE_MODULES:-}" # only used during the first initialization
 export DRUPAL_CONFIG_SYNC_DIR="${DRUPAL_CONFIG_SYNC_DIR:-}" # only used during the first initialization
 export DRUPAL_HASH_SALT="${DRUPAL_HASH_SALT:-}" # only used during the first initialization
+export DRUPAL_TRUSTED_HOSTS="${DRUPAL_TRUSTED_HOSTS:-}"
 
 # Drupal credentials
 export DRUPAL_USERNAME="${DRUPAL_USERNAME:-user}" # only used during the first initialization
diff --git a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/libdrupal.sh b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/libdrupal.sh
index 4c4fea245cf9..5d1e0711e335 100644
--- a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/libdrupal.sh
+++ b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/libdrupal.sh
@@ -193,6 +193,8 @@ drupal_initialize() {
         drupal_update_database
     fi
 
+    [[ -n "${DRUPAL_TRUSTED_HOSTS:-}" ]] && drupal_conf_set "\$settings['trusted_host_patterns']" "$DRUPAL_TRUSTED_HOSTS"
+
     # Avoid exit code of previous commands to affect the result of this function
     true
 }
@@ -477,7 +479,7 @@ drupal_set_database_ssl_settings() {
   'driver' => 'mysql',
   'pdo' => array (
     PDO::MYSQL_ATTR_SSL_CA => '${DRUPAL_DATABASE_TLS_CA_FILE}',
-    PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => 0
+    PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => 1
   )
 );
 EOF
@@ -552,7 +554,7 @@ SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
 </Files>
 
 # If we know how to do it safely, disable the PHP engine entirely.
-<IfModule mod_php7.c>
+<IfModule mod_php8.c>
   php_flag engine off
 </IfModule>
 EOF
diff --git a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh
index 1a3ae0d0dc67..97ab588065ce 100644
--- a/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh
+++ b/bitnami/drupal/11/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh
@@ -263,12 +263,6 @@ mysql_execute_print_output() {
     fi
     args+=("-N" "-u" "$user")
     [[ -n "$db" ]] && args+=("$db")
-    # Avoid passing credentials as arguments to mysql, to avoid leaking them given a local observer with /proc read access can read them
-    if [[ -n "$pass" ]]; then
-        local pass_file
-        pass_file="$(credential_to_temp_file "$pass")"
-        args+=("-p$(<"$pass_file")")
-    fi
     [[ "${#opts[@]}" -gt 0 ]] && args+=("${opts[@]}")
     [[ "${#extra_opts[@]}" -gt 0 ]] && args+=("${extra_opts[@]}")
 
@@ -276,11 +270,19 @@ mysql_execute_print_output() {
     if [[ "${BITNAMI_DEBUG:-false}" = true ]]; then
         local mysql_cmd
         mysql_cmd="$(</dev/stdin)"
-        "$(mysql_binary)" "${args[@]}" <<<"$mysql_cmd"
+        if [[ -n "$pass" ]]; then
+            MYSQL_PWD="$pass" "$(mysql_binary)" "${args[@]}" <<<"$mysql_cmd"
+        else
+            "$(mysql_binary)" "${args[@]}" <<<"$mysql_cmd"
+        fi
     else
         # Do not store the command(s) as a variable, to avoid issues when importing large files
         # https://github.com/bitnami/bitnami-docker-mariadb/issues/251
-        "$(mysql_binary)" "${args[@]}"
+        if [[ -n "$pass" ]]; then
+            MYSQL_PWD="$pass" "$(mysql_binary)" "${args[@]}"
+        else
+            "$(mysql_binary)" "${args[@]}"
+        fi
     fi
 }
 
@@ -992,13 +994,10 @@ mysql_healthcheck() {
 
     root_password="$(get_master_env_var_value ROOT_PASSWORD)"
     if [[ -n "$root_password" ]]; then
-        # Avoid passing credentials as arguments to mysqladmin, to avoid leaking them given a local observer with /proc read access can read them
-        local root_password_file
-        root_password_file="$(credential_to_temp_file "$root_password")"
-        args+=("-p$(<"$root_password_file")")
+        MYSQL_PWD="$root_password" mysqladmin "${args[@]}" ping && MYSQL_PWD="$root_password" mysqladmin "${args[@]}" status
+    else
+        mysqladmin "${args[@]}" ping && mysqladmin "${args[@]}" status
     fi
-
-    mysqladmin "${args[@]}" ping && mysqladmin "${args[@]}" status
 }
 
 ########################
diff --git a/bitnami/drupal/README.md b/bitnami/drupal/README.md
index 4cc691cf3882..ef10049d10dc 100644
--- a/bitnami/drupal/README.md
+++ b/bitnami/drupal/README.md
@@ -85,6 +85,7 @@ The following tables list the main variables you can set.
 | `DRUPAL_ENABLE_MODULES`       | Comma or space separated list of installed modules to enable during the first initialization.                                | `nil`                               |
 | `DRUPAL_CONFIG_SYNC_DIR`      | Drupal sync configuration directory location. Only used when `DRUPAL_SKIP_BOOTSTRAP` is enabled.                             | `nil`                               |
 | `DRUPAL_HASH_SALT`            | Drupal string used to generate random values. Only used when `DRUPAL_SKIP_BOOTSTRAP` is enabled.                             | `nil`                               |
+| `DRUPAL_TRUSTED_HOSTS`        | Trusted hosts patterns to configure (HTTP HOST Header attacks protection).                                                   | `nil`                               |
 | `DRUPAL_USERNAME`             | Drupal user name.                                                                                                            | `user`                              |
 | `DRUPAL_PASSWORD`             | Drupal user password.                                                                                                        | `nil`                               |
 | `DRUPAL_EMAIL`                | Drupal user e-mail address.                                                                                                  | `user@example.com`                  |