diff --git a/content/en/docs/deployment/pad/docker-pad.md b/content/en/docs/deployment/pad/docker-pad.md
index 0c4c6f07b3d..90a422750a7 100644
--- a/content/en/docs/deployment/pad/docker-pad.md
+++ b/content/en/docs/deployment/pad/docker-pad.md
@@ -163,11 +163,15 @@ services:
     command: ["./bin/start", "etc/Default"]
 ```
 
+### Security Recommendations
+
+Do not store secrets in plain text within Docker Compose YAML files, Kubernetes Secret manifests, application configuration files, or source code repositories. If these files are accidentally committed to a repository, shared externally, or uploaded to another platform, credentials may be exposed. Use a dedicated secret management mechanism and inject secrets during deployment whenever possible.
+
 ### Running with Docker Compose
 
 To use this Docker Compose configuration, perform the following steps:
 
-1. Set your admin port password in the **M2EE_ADMIN_PASS** variable within your environment, or directly in the *docker-compose.yaml* file.
+1. Set your admin port password in the **M2EE_ADMIN_PASS** variable within your environment.
 2. Navigate to the directory containing your *docker-compose.yaml* file
 3. Run a command like the following: `docker compose -f docker_compose/Default.yaml up`
 
@@ -204,6 +208,10 @@ Alternatively, you can configure the Mendix Runtime by using a configuration fil
 }
 ```
 
+### Security Recommendations 
+
+Do not store secrets in plain text within Docker Compose YAML files, Kubernetes Secret manifests, application configuration files, or source code repositories. If these files are accidentally committed to a repository, shared externally, or uploaded to another platform, credentials may be exposed. Use a dedicated secret management mechanism and inject secrets during deployment whenever possible.
+
 ### Using the Configuration File
 
 To use the configuration file, you can upload the configuration file to the configuration path: