diff --git a/5.0/alpine3.20/Dockerfile b/5.0/alpine3.20/Dockerfile
index a37c64c..a6f0e59 100644
--- a/5.0/alpine3.20/Dockerfile
+++ b/5.0/alpine3.20/Dockerfile
@@ -82,6 +82,15 @@ RUN set -eux; \
 	wget -O redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
 	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
 	tar -xf redmine.tar.gz --strip-components=1; \
+	# https://www.redmine.org/issues/42113 (aka https://github.com/rails/rails/issues/54260)
+	# 5.1: https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4
+	# 5.0: https://github.com/redmine/redmine/commit/f27570120b7a672249bfebfe4d62da506785e146
+	apk add --no-cache patch; \
+	wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \
+	echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \
+	patch -p1 < 42113.patch; \
+	rm 42113.patch; \
+	apk del --no-network patch; \
 	rm redmine.tar.gz files/delete.me log/delete.me; \
 	mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids; \
 	chown -R redmine:redmine ./; \
diff --git a/5.0/alpine3.20/docker-entrypoint.sh b/5.0/alpine3.20/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/5.0/alpine3.20/docker-entrypoint.sh
+++ b/5.0/alpine3.20/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/5.0/alpine3.21/Dockerfile b/5.0/alpine3.21/Dockerfile
index 4af7ac4..073df21 100644
--- a/5.0/alpine3.21/Dockerfile
+++ b/5.0/alpine3.21/Dockerfile
@@ -82,6 +82,15 @@ RUN set -eux; \
 	wget -O redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
 	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
 	tar -xf redmine.tar.gz --strip-components=1; \
+	# https://www.redmine.org/issues/42113 (aka https://github.com/rails/rails/issues/54260)
+	# 5.1: https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4
+	# 5.0: https://github.com/redmine/redmine/commit/f27570120b7a672249bfebfe4d62da506785e146
+	apk add --no-cache patch; \
+	wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \
+	echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \
+	patch -p1 < 42113.patch; \
+	rm 42113.patch; \
+	apk del --no-network patch; \
 	rm redmine.tar.gz files/delete.me log/delete.me; \
 	mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids; \
 	chown -R redmine:redmine ./; \
diff --git a/5.0/alpine3.21/docker-entrypoint.sh b/5.0/alpine3.21/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/5.0/alpine3.21/docker-entrypoint.sh
+++ b/5.0/alpine3.21/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/5.0/bookworm/Dockerfile b/5.0/bookworm/Dockerfile
index e990c48..2b99658 100644
--- a/5.0/bookworm/Dockerfile
+++ b/5.0/bookworm/Dockerfile
@@ -86,6 +86,17 @@ RUN set -eux; \
 	curl -fL -o redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
 	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
 	tar -xf redmine.tar.gz --strip-components=1; \
+	# https://www.redmine.org/issues/42113 (aka https://github.com/rails/rails/issues/54260)
+	# 5.1: https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4
+	# 5.0: https://github.com/redmine/redmine/commit/f27570120b7a672249bfebfe4d62da506785e146
+	apt-get update; \
+	apt-get install -y --no-install-recommends patch; \
+	wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \
+	echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \
+	patch -p1 < 42113.patch; \
+	rm 42113.patch; \
+	apt-get purge -y --auto-remove patch; \
+	rm -rf /var/lib/apt/lists/*; \
 	rm redmine.tar.gz files/delete.me log/delete.me; \
 	mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids; \
 	chown -R redmine:redmine ./; \
diff --git a/5.0/bookworm/docker-entrypoint.sh b/5.0/bookworm/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/5.0/bookworm/docker-entrypoint.sh
+++ b/5.0/bookworm/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/5.1/alpine3.20/Dockerfile b/5.1/alpine3.20/Dockerfile
index 1068ebc..7892d99 100644
--- a/5.1/alpine3.20/Dockerfile
+++ b/5.1/alpine3.20/Dockerfile
@@ -82,6 +82,15 @@ RUN set -eux; \
 	wget -O redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
 	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
 	tar -xf redmine.tar.gz --strip-components=1; \
+	# https://www.redmine.org/issues/42113 (aka https://github.com/rails/rails/issues/54260)
+	# 5.1: https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4
+	# 5.0: https://github.com/redmine/redmine/commit/f27570120b7a672249bfebfe4d62da506785e146
+	apk add --no-cache patch; \
+	wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \
+	echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \
+	patch -p1 < 42113.patch; \
+	rm 42113.patch; \
+	apk del --no-network patch; \
 	rm redmine.tar.gz files/delete.me log/delete.me; \
 	mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids; \
 	chown -R redmine:redmine ./; \
diff --git a/5.1/alpine3.20/docker-entrypoint.sh b/5.1/alpine3.20/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/5.1/alpine3.20/docker-entrypoint.sh
+++ b/5.1/alpine3.20/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/5.1/alpine3.21/Dockerfile b/5.1/alpine3.21/Dockerfile
index d6338a0..2d593e9 100644
--- a/5.1/alpine3.21/Dockerfile
+++ b/5.1/alpine3.21/Dockerfile
@@ -82,6 +82,15 @@ RUN set -eux; \
 	wget -O redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
 	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
 	tar -xf redmine.tar.gz --strip-components=1; \
+	# https://www.redmine.org/issues/42113 (aka https://github.com/rails/rails/issues/54260)
+	# 5.1: https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4
+	# 5.0: https://github.com/redmine/redmine/commit/f27570120b7a672249bfebfe4d62da506785e146
+	apk add --no-cache patch; \
+	wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \
+	echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \
+	patch -p1 < 42113.patch; \
+	rm 42113.patch; \
+	apk del --no-network patch; \
 	rm redmine.tar.gz files/delete.me log/delete.me; \
 	mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids; \
 	chown -R redmine:redmine ./; \
diff --git a/5.1/alpine3.21/docker-entrypoint.sh b/5.1/alpine3.21/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/5.1/alpine3.21/docker-entrypoint.sh
+++ b/5.1/alpine3.21/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/5.1/bookworm/Dockerfile b/5.1/bookworm/Dockerfile
index f075cb1..2407bb3 100644
--- a/5.1/bookworm/Dockerfile
+++ b/5.1/bookworm/Dockerfile
@@ -86,6 +86,17 @@ RUN set -eux; \
 	curl -fL -o redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
 	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
 	tar -xf redmine.tar.gz --strip-components=1; \
+	# https://www.redmine.org/issues/42113 (aka https://github.com/rails/rails/issues/54260)
+	# 5.1: https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4
+	# 5.0: https://github.com/redmine/redmine/commit/f27570120b7a672249bfebfe4d62da506785e146
+	apt-get update; \
+	apt-get install -y --no-install-recommends patch; \
+	wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \
+	echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \
+	patch -p1 < 42113.patch; \
+	rm 42113.patch; \
+	apt-get purge -y --auto-remove patch; \
+	rm -rf /var/lib/apt/lists/*; \
 	rm redmine.tar.gz files/delete.me log/delete.me; \
 	mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids; \
 	chown -R redmine:redmine ./; \
diff --git a/5.1/bookworm/docker-entrypoint.sh b/5.1/bookworm/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/5.1/bookworm/docker-entrypoint.sh
+++ b/5.1/bookworm/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/6.0/alpine3.20/docker-entrypoint.sh b/6.0/alpine3.20/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/6.0/alpine3.20/docker-entrypoint.sh
+++ b/6.0/alpine3.20/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/6.0/alpine3.21/docker-entrypoint.sh b/6.0/alpine3.21/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/6.0/alpine3.21/docker-entrypoint.sh
+++ b/6.0/alpine3.21/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/6.0/bookworm/docker-entrypoint.sh b/6.0/bookworm/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/6.0/bookworm/docker-entrypoint.sh
+++ b/6.0/bookworm/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi
diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
index 5f69a7c..38f8b5e 100644
--- a/Dockerfile-alpine.template
+++ b/Dockerfile-alpine.template
@@ -53,7 +53,7 @@ RUN set -eux; \
 	chmod +x /usr/local/bin/gosu; \
 	gosu --version; \
 	gosu nobody true
-{{ if [ "5.0", "5.1" ] | index(env.version) then ( -}}
+{{ if env.version | IN("5.0", "5.1") then ( -}}
 RUN set -eux; ln -svf gosu /usr/local/bin/su-exec; su-exec nobody true # backwards compatibility (removed in Redmine 5.2+)
 {{ ) else "" end -}}
 
@@ -78,6 +78,17 @@ RUN set -eux; \
 	wget -O redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
 	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
 	tar -xf redmine.tar.gz --strip-components=1; \
+{{ if .version | IN("5.0.10", "5.1.5") then ( -}}
+	# https://www.redmine.org/issues/42113 (aka https://github.com/rails/rails/issues/54260)
+	# 5.1: https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4
+	# 5.0: https://github.com/redmine/redmine/commit/f27570120b7a672249bfebfe4d62da506785e146
+	apk add --no-cache patch; \
+	wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \
+	echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \
+	patch -p1 < 42113.patch; \
+	rm 42113.patch; \
+	apk del --no-network patch; \
+{{ ) else "" end -}}
 	rm redmine.tar.gz files/delete.me log/delete.me; \
 	mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids; \
 	chown -R redmine:redmine ./; \
diff --git a/Dockerfile-debian.template b/Dockerfile-debian.template
index 494533d..4ed97fc 100644
--- a/Dockerfile-debian.template
+++ b/Dockerfile-debian.template
@@ -80,6 +80,19 @@ RUN set -eux; \
 	curl -fL -o redmine.tar.gz "$REDMINE_DOWNLOAD_URL"; \
 	echo "$REDMINE_DOWNLOAD_SHA256 *redmine.tar.gz" | sha256sum -c -; \
 	tar -xf redmine.tar.gz --strip-components=1; \
+{{ if .version | IN("5.0.10", "5.1.5") then ( -}}
+	# https://www.redmine.org/issues/42113 (aka https://github.com/rails/rails/issues/54260)
+	# 5.1: https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4
+	# 5.0: https://github.com/redmine/redmine/commit/f27570120b7a672249bfebfe4d62da506785e146
+	apt-get update; \
+	apt-get install -y --no-install-recommends patch; \
+	wget -O 42113.patch 'https://github.com/redmine/redmine/commit/c7b1f00fc1b42fd9f77b8e6574dae453ced642b4.patch?full_index=1'; \
+	echo 'e352699be3995ff6e3b0066a478e377922fa95ce9fe4729240cd98dcee3c8575 *42113.patch' | sha256sum -c -; \
+	patch -p1 < 42113.patch; \
+	rm 42113.patch; \
+	apt-get purge -y --auto-remove patch; \
+	rm -rf /var/lib/apt/lists/*; \
+{{ ) else "" end -}}
 	rm redmine.tar.gz files/delete.me log/delete.me; \
 	mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids; \
 	chown -R redmine:redmine ./; \
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 62c56ea..9a1640a 100755
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -139,17 +139,24 @@ if [ -n "$isLikelyRedmine" ]; then
 	# install additional gems for Gemfile.local and plugins
 	bundle check || bundle install
 
-	if [ ! -s config/secrets.yml ]; then
-		file_env 'REDMINE_SECRET_KEY_BASE'
-		if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
-			cat > 'config/secrets.yml' <<-YML
-				$RAILS_ENV:
-				  secret_key_base: "$REDMINE_SECRET_KEY_BASE"
-			YML
-		elif [ ! -f config/initializers/secret_token.rb ]; then
-			rake generate_secret_token
-		fi
+	file_env 'REDMINE_SECRET_KEY_BASE'
+	# just use the rails variable rather than trying to put it into a yml file
+	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
+	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
+	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+		echo >&2
+		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
+		echo >&2
+	fi
+	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	export SECRET_KEY_BASE
+	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
+	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
+		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+		unset SECRET_KEY_BASE # just in case
+		rake generate_secret_token
 	fi
+
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
 		rake db:migrate
 	fi