diff --git a/5.1/alpine3.21/docker-entrypoint.sh b/5.1/alpine3.21/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/5.1/alpine3.21/docker-entrypoint.sh
+++ b/5.1/alpine3.21/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/5.1/alpine3.22/docker-entrypoint.sh b/5.1/alpine3.22/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/5.1/alpine3.22/docker-entrypoint.sh
+++ b/5.1/alpine3.22/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/5.1/bookworm/docker-entrypoint.sh b/5.1/bookworm/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/5.1/bookworm/docker-entrypoint.sh
+++ b/5.1/bookworm/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/5.1/trixie/docker-entrypoint.sh b/5.1/trixie/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/5.1/trixie/docker-entrypoint.sh
+++ b/5.1/trixie/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/6.0/alpine3.21/docker-entrypoint.sh b/6.0/alpine3.21/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/6.0/alpine3.21/docker-entrypoint.sh
+++ b/6.0/alpine3.21/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/6.0/alpine3.22/docker-entrypoint.sh b/6.0/alpine3.22/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/6.0/alpine3.22/docker-entrypoint.sh
+++ b/6.0/alpine3.22/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/6.0/bookworm/docker-entrypoint.sh b/6.0/bookworm/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/6.0/bookworm/docker-entrypoint.sh
+++ b/6.0/bookworm/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/6.0/trixie/docker-entrypoint.sh b/6.0/trixie/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/6.0/trixie/docker-entrypoint.sh
+++ b/6.0/trixie/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/6.1/alpine3.21/docker-entrypoint.sh b/6.1/alpine3.21/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/6.1/alpine3.21/docker-entrypoint.sh
+++ b/6.1/alpine3.21/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/6.1/alpine3.22/docker-entrypoint.sh b/6.1/alpine3.22/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/6.1/alpine3.22/docker-entrypoint.sh
+++ b/6.1/alpine3.22/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/6.1/bookworm/docker-entrypoint.sh b/6.1/bookworm/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/6.1/bookworm/docker-entrypoint.sh
+++ b/6.1/bookworm/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/6.1/trixie/docker-entrypoint.sh b/6.1/trixie/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/6.1/trixie/docker-entrypoint.sh
+++ b/6.1/trixie/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 0bcee63..f956052 100755
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -144,18 +144,25 @@ if [ -n "$isLikelyRedmine" ]; then
 	# just use the rails variable rather than trying to put it into a yml file
 	# https://github.com/rails/rails/blob/6-1-stable/railties/lib/rails/application.rb#L438
 	# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L484 (rails 7.1-stable)
-	if [ -n "${SECRET_KEY_BASE}" ] && [ -n "${REDMINE_SECRET_KEY_BASE}" ]; then
+	if [ -n "${SECRET_KEY_BASE:-}" ] && [ -n "${REDMINE_SECRET_KEY_BASE:-}" ]; then
 		echo >&2
 		echo >&2 'warning: both SECRET_KEY_BASE and REDMINE_SECRET_KEY_BASE{_FILE} set, only SECRET_KEY_BASE will apply'
 		echo >&2
 	fi
-	: "${SECRET_KEY_BASE:=$REDMINE_SECRET_KEY_BASE}"
+	: "${SECRET_KEY_BASE:=${REDMINE_SECRET_KEY_BASE:-}}"
 	export SECRET_KEY_BASE
-	# generate SECRET_KEY_BASE if not set; this is not recommended unless the secret_token.rb is saved when container is recreated
-	if [ -z "$SECRET_KEY_BASE" ] && [ ! -f config/initializers/secret_token.rb ]; then
-		echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
-		unset SECRET_KEY_BASE # just in case
-		rake generate_secret_token
+	if [ -z "$SECRET_KEY_BASE" ]; then
+		# https://github.com/docker-library/redmine/issues/397
+		# empty string is truthy in ruby and so masks the generated fallback config
+		# https://github.com/rails/rails/blob/1aa9987169213ce5ce43c20b2643bc64c235e792/railties/lib/rails/application.rb#L454
+		unset SECRET_KEY_BASE
+		# generate SECRET_KEY_BASE in-file since it is not set or empty; this is not recommended unless the secret_token.rb is saved when container is recreated
+		if [ ! -f config/initializers/secret_token.rb ]; then
+			echo >&2
+			echo >&2 'warning: no *SECRET_KEY_BASE set; running `rake generate_secret_token` to create one in "config/initializers/secret_token.rb"'
+			echo >&2
+			rake generate_secret_token
+		fi
 	fi
 
 	if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then