diff --git a/docker/Dockerfile.local b/docker/Dockerfile.local
index 2c43f9331..9a0467318 100644
--- a/docker/Dockerfile.local
+++ b/docker/Dockerfile.local
@@ -4,7 +4,7 @@ COPY  ./weed /usr/bin/weed
 RUN chmod +x /usr/bin/weed && ls -la /usr/bin/weed
 RUN mkdir -p /etc/seaweedfs
 COPY ./filer.toml /etc/seaweedfs/filer.toml
-COPY ./security.toml /etc/seaweedfs/security.toml
+COPY ./security.toml.example /etc/seaweedfs/security.toml.example
 COPY ./entrypoint.sh /entrypoint.sh
 
 # Install dependencies and create non-root user
diff --git a/docker/security.toml b/docker/security.toml.example
similarity index 92%
rename from docker/security.toml
rename to docker/security.toml.example
index 4581e8824..1a75d915a 100644
--- a/docker/security.toml
+++ b/docker/security.toml.example
@@ -14,21 +14,21 @@ values = "*"
 # - the Volume server validates the JWT on writing
 # the jwt defaults to expire after 10 seconds.
 [jwt.signing]
-key = "T3A0RDNWNU1HaA=="
+key = "<REPLACE_AT_RUNTIME>"
 # this jwt signing key is read by master and volume server, and it is used for read operations:
 # - the Master server generates the JWT, which can be used to read a certain file on a volume server
 # - the Volume server validates the JWT on reading
 [jwt.signing.read]
-key = "bWVvQm5wdFRRdg=="
+key = "<REPLACE_AT_RUNTIME>"
 # If this JWT key is configured, Filer only accepts writes over HTTP if they are signed with this JWT:
 # - f.e. the S3 API Shim generates the JWT
 # - the Filer server validates the JWT on writing
 # the jwt defaults to expire after 10 seconds.
 [jwt.filer_signing]
-key = "UmF3WGxYV0JYSw=="
+key = "<REPLACE_AT_RUNTIME>"
 # If this JWT key is configured, Filer only accepts reads over HTTP if they are signed with this JWT:
 # - f.e. the S3 API Shim generates the JWT
 # - the Filer server validates the JWT on writing
 # the jwt defaults to expire after 10 seconds.
 [jwt.filer_signing.read]
-key = "T1pPekFzNWV4OQ=="
+key = "<REPLACE_AT_RUNTIME>"