diff --git a/bitnami/keycloak/26/debian-12/Dockerfile b/bitnami/keycloak/26/debian-12/Dockerfile
index 11c9fc98e552..2f724c3002b3 100644
--- a/bitnami/keycloak/26/debian-12/Dockerfile
+++ b/bitnami/keycloak/26/debian-12/Dockerfile
@@ -8,13 +8,13 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security"
 ARG TARGETARCH
 
 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-06-11T03:50:59Z" \
+      org.opencontainers.image.created="2026-06-26T20:54:34Z" \
       org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
       org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/keycloak/README.md" \
       org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/keycloak" \
       org.opencontainers.image.title="keycloak" \
       org.opencontainers.image.vendor="Broadcom, Inc." \
-      org.opencontainers.image.version="26.6.3"
+      org.opencontainers.image.version="26.6.4"
 
 ENV HOME="/" \
     OS_ARCH="${TARGETARCH:-amd64}" \
@@ -29,9 +29,9 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
     DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \
     mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \
     COMPONENTS=( \
-      "wait-for-port-1.0.10-11-linux-${OS_ARCH}-debian-12" \
+      "wait-for-port-1.0.10-13-linux-${OS_ARCH}-debian-12" \
       "jre-21.0.11-11-1-linux-${OS_ARCH}-debian-12" \
-      "keycloak-26.6.3-1-linux-${OS_ARCH}-debian-12" \
+      "keycloak-26.6.4-0-linux-${OS_ARCH}-debian-12" \
     ) ; \
     for COMPONENT in "${COMPONENTS[@]}"; do \
       if [ ! -f "${COMPONENT}.tar.gz" ]; then \
@@ -50,9 +50,9 @@ RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true
 COPY rootfs /
 RUN /opt/bitnami/scripts/java/postunpack.sh
 RUN /opt/bitnami/scripts/keycloak/postunpack.sh
-ENV APP_VERSION="26.6.3" \
+ENV APP_VERSION="26.6.4" \
     BITNAMI_APP_NAME="keycloak" \
-    IMAGE_REVISION="2" \
+    IMAGE_REVISION="0" \
     JAVA_HOME="/opt/bitnami/java" \
     PATH="/opt/bitnami/common/bin:/opt/bitnami/java/bin:/opt/bitnami/keycloak/bin:$PATH"
 
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.3-1-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.3-1-linux-amd64-debian-12.tar.gz.sha256
deleted file mode 100644
index 880e039bc77d..000000000000
--- a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.3-1-linux-amd64-debian-12.tar.gz.sha256
+++ /dev/null
@@ -1 +0,0 @@
-e292e98a1dcf6177a8413a7eee6fa88b1350826db9913199fd50ab8170cf2b83  keycloak-26.6.3-1-linux-amd64-debian-12.tar.gz
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.3-1-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.3-1-linux-arm64-debian-12.tar.gz.sha256
deleted file mode 100644
index 9549452cd73e..000000000000
--- a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.3-1-linux-arm64-debian-12.tar.gz.sha256
+++ /dev/null
@@ -1 +0,0 @@
-55d11ef5c78246354378641a56dd79ac466986160cf4acacc9b7ec2e02e739a5  keycloak-26.6.3-1-linux-arm64-debian-12.tar.gz
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.4-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.4-0-linux-amd64-debian-12.tar.gz.sha256
new file mode 100644
index 000000000000..57f8c5e86a36
--- /dev/null
+++ b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.4-0-linux-amd64-debian-12.tar.gz.sha256
@@ -0,0 +1 @@
+6db40cf4a875d4f0fd571d2bc422d055f73144a4bdeace217c54377b7464fd13  keycloak-26.6.4-0-linux-amd64-debian-12.tar.gz
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.4-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.4-0-linux-arm64-debian-12.tar.gz.sha256
new file mode 100644
index 000000000000..692eae1470c3
--- /dev/null
+++ b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/keycloak-26.6.4-0-linux-arm64-debian-12.tar.gz.sha256
@@ -0,0 +1 @@
+cac929f143d1bd2931a263eccaf01bf6617867424554a58c930c9432f6d9b71b  keycloak-26.6.4-0-linux-arm64-debian-12.tar.gz
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz.sha256
deleted file mode 100644
index ab86dab7c5d1..000000000000
--- a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz.sha256
+++ /dev/null
@@ -1 +0,0 @@
-b8a9cd842e95ae16de5bbf157cc7e246c79a24d3b5b626bcce32f6904a895383  wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz.sha256
deleted file mode 100644
index 3799475af672..000000000000
--- a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz.sha256
+++ /dev/null
@@ -1 +0,0 @@
-ae2e822f8c673eb66a2cadbc6dc5fe9c8c0791564751e453a04a416ab9bd6f61  wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-13-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-13-linux-amd64-debian-12.tar.gz.sha256
new file mode 100644
index 000000000000..508533b8af2b
--- /dev/null
+++ b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-13-linux-amd64-debian-12.tar.gz.sha256
@@ -0,0 +1 @@
+a6e453ebb01a25354771584cac544f1c7142ffcf81b9d88fb0ab5d5e9d23ba54  wait-for-port-1.0.10-13-linux-amd64-debian-12.tar.gz
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-13-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-13-linux-arm64-debian-12.tar.gz.sha256
new file mode 100644
index 000000000000..a4929821d088
--- /dev/null
+++ b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-13-linux-arm64-debian-12.tar.gz.sha256
@@ -0,0 +1 @@
+e10e80f03ddd46d5fa479f3ca6cf24e6317540202cb244769167a91b3afbc9fc  wait-for-port-1.0.10-13-linux-arm64-debian-12.tar.gz
diff --git a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh
index 18445e7d27fa..833ee5ab1d65 100644
--- a/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh
+++ b/bitnami/keycloak/26/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh
@@ -39,7 +39,7 @@ persist_app() {
     fi
     pushd "$install_dir" >/dev/null || exit
     local file_to_persist_relative file_to_persist_destination file_to_persist_destination_folder
-    local -r tmp_file="/tmp/perms.acl"
+    local -r acl_file="$(mktemp "${TMPDIR:-/tmp}"/acl.XXXXXXXXXX)"
     for file_to_persist in "${files_to_persist[@]}"; do
         if [[ ! -f "$file_to_persist" && ! -d "$file_to_persist" ]]; then
             error "Cannot persist '${file_to_persist}' because it does not exist"
@@ -50,22 +50,22 @@ persist_app() {
         file_to_persist_destination_folder="$(dirname "$file_to_persist_destination")"
         # Get original permissions for existing files, which will be applied later
         # Exclude the root directory with 'sed', to avoid issues when copying the entirety of it to a volume
-        getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$tmp_file"
+        getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$acl_file"
         # Copy directories to the volume
         ensure_dir_exists "$file_to_persist_destination_folder"
         cp -Lr --preserve=links "$file_to_persist_relative" "$file_to_persist_destination_folder"
         # Restore permissions
         pushd "$persist_dir" >/dev/null || exit
         if am_i_root; then
-            setfacl --restore="$tmp_file"
+            setfacl --restore="$acl_file"
         else
             # When running as non-root, don't change ownership
-            setfacl --restore=<(grep -E -v '^# (owner|group):' "$tmp_file")
+            setfacl --restore=<(grep -E -v '^# (owner|group):' "$acl_file")
         fi
         popd >/dev/null || exit
     done
     popd >/dev/null || exit
-    rm -f "$tmp_file"
+    rm -f "$acl_file"
     # Install the persisted files into the installation directory, via symlinks
     restore_persisted_app "$@"
 }