diff --git a/bitnami/ejbca/9/debian-12/Dockerfile b/bitnami/ejbca/9/debian-12/Dockerfile
index 04b16b744168..cc2aeeacd35a 100644
--- a/bitnami/ejbca/9/debian-12/Dockerfile
+++ b/bitnami/ejbca/9/debian-12/Dockerfile
@@ -8,7 +8,7 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security"
 ARG TARGETARCH
 
 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-05-21T01:38:41Z" \
+      org.opencontainers.image.created="2026-05-22T14:16:08Z" \
       org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
       org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/ejbca/README.md" \
       org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/ejbca" \
@@ -54,7 +54,7 @@ RUN /opt/bitnami/scripts/ejbca/postunpack.sh
 RUN /opt/bitnami/scripts/java/postunpack.sh
 ENV APP_VERSION="9.3.7" \
     BITNAMI_APP_NAME="ejbca" \
-    IMAGE_REVISION="10" \
+    IMAGE_REVISION="11" \
     JAVA_HOME="/opt/bitnami/java" \
     PATH="/opt/bitnami/wildfly/bin:/opt/bitnami/java/bin:/opt/bitnami/mysql/bin:/opt/bitnami/ejbca/bin:$PATH"
 
diff --git a/bitnami/ejbca/9/debian-12/docker-compose.yml b/bitnami/ejbca/9/debian-12/docker-compose.yml
index c80e524b03c6..84059d35634f 100644
--- a/bitnami/ejbca/9/debian-12/docker-compose.yml
+++ b/bitnami/ejbca/9/debian-12/docker-compose.yml
@@ -21,6 +21,7 @@ services:
     volumes:
       - "wildfly_data:/bitnami/wildfly"
     environment:
+      - EJBCA_ADMIN_PASSWORD=bitnami123
       - EJBCA_DATABASE_HOST=mariadb
       - EJBCA_DATABASE_NAME=bitnami_ejbca
       - EJBCA_DATABASE_USERNAME=bn_ejbca
diff --git a/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/ejbca-env.sh b/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/ejbca-env.sh
index 6ac255d5a54c..cc44d6295cff 100644
--- a/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/ejbca-env.sh
+++ b/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/ejbca-env.sh
@@ -119,7 +119,7 @@ export EJBCA_HTTP_PORT_NUMBER="${EJBCA_HTTP_PORT_NUMBER:-8080}"
 export EJBCA_HTTPS_PORT_NUMBER="${EJBCA_HTTPS_PORT_NUMBER:-8443}"
 export EJBCA_HTTPS_ADVERTISED_PORT_NUMBER="${EJBCA_HTTPS_ADVERTISED_PORT_NUMBER:-$EJBCA_HTTPS_PORT_NUMBER}"
 export EJBCA_ADMIN_USERNAME="${EJBCA_ADMIN_USERNAME:-superadmin}"
-export EJBCA_ADMIN_PASSWORD="${EJBCA_ADMIN_PASSWORD:-Bitnami1234}"
+export EJBCA_ADMIN_PASSWORD="${EJBCA_ADMIN_PASSWORD:-}"
 export EJBCA_DATABASE_FLAVOR="${EJBCA_DATABASE_FLAVOR:-mariadb}"
 export EJBCA_DATABASE_HOST="${EJBCA_DATABASE_HOST:-}"
 export EJBCA_DATABASE_PORT="${EJBCA_DATABASE_PORT:-3306}"
diff --git a/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/libejbca.sh b/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/libejbca.sh
index 458f2efedf3e..8a63d4e1aae0 100644
--- a/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/libejbca.sh
+++ b/bitnami/ejbca/9/debian-12/rootfs/opt/bitnami/scripts/libejbca.sh
@@ -389,6 +389,7 @@ ejbca_generate_ca() {
     ejbca_ca="$(ejbca_execute_command_print_output ca listcas 2>&1)"
     if ! grep -q 'CA Name: ' <<<"$ejbca_ca"; then
         info "Init CA"
+
         ejbca_execute_command ca init \
             --dn "CN=$EJBCA_CA_NAME,$EJBCA_BASE_DN" \
             --caname "$EJBCA_CA_NAME" \
@@ -401,6 +402,16 @@ ejbca_generate_ca() {
             -s "$EJBCA_CA_CERT_SIGNATURE_ALGORITHM" \
             -type "x509"
 
+        # Avoid passing EJBCA admin password as arguments to ejbca.sh, to avoid leaking them given
+        # given a local observer with /proc read access can read them
+        # Instead, we can read them from temporary files
+        local ejbca_admin_password_file
+        ejbca_admin_password_file="$(mktemp)"
+        chmod 0600 "$ejbca_admin_password_file"
+        echo "$EJBCA_ADMIN_PASSWORD" > "$ejbca_admin_password_file"
+        # shellcheck disable=SC2064
+        trap "rm -f $ejbca_admin_password_file" RETURN ERR INT TERM
+
         info "Add superadmin user"
         ejbca_execute_command ra addendentity \
             --username "$EJBCA_ADMIN_USERNAME" \
@@ -408,7 +419,7 @@ ejbca_generate_ca() {
             --caname "$EJBCA_CA_NAME" \
             --type 1 \
             --token P12 \
-            --password "$EJBCA_ADMIN_PASSWORD"
+            --password "$(<"$ejbca_admin_password_file")"
     fi
 
     ejbca_ca="$(ejbca_execute_command_print_output ca listcas 2>&1)"
diff --git a/bitnami/ejbca/README.md b/bitnami/ejbca/README.md
index c753f370ed33..46e00dafee67 100644
--- a/bitnami/ejbca/README.md
+++ b/bitnami/ejbca/README.md
@@ -82,7 +82,7 @@ The following tables list the main variables you can set.
 | `EJBCA_HTTPS_PORT_NUMBER`            | Wildfly https port number                 | `8443`                                                                                                                                                 |
 | `EJBCA_HTTPS_ADVERTISED_PORT_NUMBER` | Rendered port for administrator login URL | `$EJBCA_HTTPS_PORT_NUMBER`                                                                                                                             |
 | `EJBCA_ADMIN_USERNAME`               | EJBCA administrator username              | `superadmin`                                                                                                                                           |
-| `EJBCA_ADMIN_PASSWORD`               | EJBCA administrator password.             | `Bitnami1234`                                                                                                                                          |
+| `EJBCA_ADMIN_PASSWORD`               | EJBCA administrator password.             | `nil`                                                                                                                                                  |
 | `EJBCA_DATABASE_FLAVOR`              | EJBCA database flavor                     | `mariadb`                                                                                                                                              |
 | `EJBCA_DATABASE_HOST`                | Database hostname                         | `nil`                                                                                                                                                  |
 | `EJBCA_DATABASE_PORT`                | Database port number.                     | `3306`                                                                                                                                                 |
diff --git a/bitnami/ejbca/docker-compose.yml b/bitnami/ejbca/docker-compose.yml
index c80e524b03c6..84059d35634f 100644
--- a/bitnami/ejbca/docker-compose.yml
+++ b/bitnami/ejbca/docker-compose.yml
@@ -21,6 +21,7 @@ services:
     volumes:
       - "wildfly_data:/bitnami/wildfly"
     environment:
+      - EJBCA_ADMIN_PASSWORD=bitnami123
       - EJBCA_DATABASE_HOST=mariadb
       - EJBCA_DATABASE_NAME=bitnami_ejbca
       - EJBCA_DATABASE_USERNAME=bn_ejbca