diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41c34b9..fca439e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,21 @@
 
 ## 2026-08-18
 
+* Added
+  * Env variable `OWNCLOUD_WOPI_PROXY_KEY` for the `wopi.proxy.key` config key,
+    and the `OWNCLOUD_WOPI_*` variables are now also available for Ubuntu 22.04
+    (ownCloud 10.16.x), so the WOPI signing keys no longer have to be set from a
+    custom hook script
+    [#545](https://github.com/owncloud-docker/base/issues/545)
+  * README section describing the hook directories, and how to keep a secret out
+    of the log when a hook has to pass it to `occ`
+    [#545](https://github.com/owncloud-docker/base/issues/545)
+
 * Fixed
+  * `DEBUG=true` no longer prints `OWNCLOUD_WOPI_TOKEN_KEY`,
+    `OWNCLOUD_METRICS_SHARED_SECRET` and `OWNCLOUD_PROXY_USERPWD`, which were
+    missed by the previous xtrace fix
+    [#544](https://github.com/owncloud-docker/base/issues/544)
   * Apps that ship in the image are no longer sent to the marketplace, so listing
     one in `OWNCLOUD_APPS_INSTALL` no longer aborts the container startup. A
     failing marketplace install now logs why it failed
diff --git a/ENVIRONMENT.md b/ENVIRONMENT.md
index 7a4d0f1..4ed5e04 100644
--- a/ENVIRONMENT.md
+++ b/ENVIRONMENT.md
@@ -496,6 +496,8 @@
   Restrict Microsoft Office Online access to a specific group (Enterprise only) (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/server/config_apps_sample_php_parameters.html#app-microsoft-office-online-wopi)).
 - `OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER=` \
   URL of the Microsoft Office Online server (Enterprise only) (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/server/config_apps_sample_php_parameters.html#app-microsoft-office-online-wopi)).
+- `OWNCLOUD_WOPI_PROXY_KEY=` \
+  Random key (minimum 32 bytes) used to verify business proxy tokens, must differ from `OWNCLOUD_WOPI_TOKEN_KEY` (Enterprise only) (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/server/config_apps_sample_php_parameters.html#app-microsoft-office-online-wopi)).
 - `OWNCLOUD_WOPI_PROXY_URL=` \
   Business proxy URL for Microsoft Office 365 (Enterprise only) (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/server/config_apps_sample_php_parameters.html#app-microsoft-office-online-wopi)).
 - `OWNCLOUD_WOPI_TOKEN_KEY=` \
diff --git a/README.md b/README.md
index 8b3b38f..f3df341 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,34 @@ ownCloud Docker base image.
 - `OWNCLOUD_LICENSE_KEY=` \
   ownCloud Enterprise License Key (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/enterprise/installation/install.html#license-keys)).
 
+## Custom hook scripts
+
+Executable `*.sh` files placed in one of the hook directories are sourced in
+alphabetical order at a defined point of the startup. `/etc/owncloud.d` runs on
+every container start before the actual command is executed, `/etc/entrypoint.d`
+runs even earlier and is meant for environment defaults only.
+`/etc/pre_install.d` and
+`/etc/post_install.d` wrap the initial `maintenance:install`,
+`/etc/pre_server.d` and `/etc/post_server.d` wrap the server start, and
+`/etc/pre_cronjob.d` and `/etc/post_cronjob.d` wrap each cronjob run. All paths
+can be relocated with the matching `OWNCLOUD_*_PATH` variable.
+
+Prefer a documented environment variable over a hook whenever one exists: the
+generated config file is never echoed, while a secret handed to `occ` on the
+command line is printed at least twice — once by the shell trace if
+`DEBUG=true`, once by `occ` itself, which echoes the value back. If a hook has
+to pass a secret to `occ`, suppress both:
+
+```bash
+{ set +x; } 2>/dev/null                                            # no shell trace
+occ config:app:set onlyoffice jwt_secret --value "${SECRET}" -q     # no echo
+[[ "${DEBUG}" == "true" ]] && set -x
+```
+
+Note that this still does not stop the `admin_audit` app from recording the full
+`occ` argument list in `owncloud.log`, including the secret. Only ownCloud itself
+can redact that.
+
 ## Community & Support
 
 - [ownCloud Website](https://owncloud.com)
diff --git a/v22.04/overlay/etc/entrypoint.d/85-others.sh b/v22.04/overlay/etc/entrypoint.d/85-others.sh
index a255a59..bf19d82 100755
--- a/v22.04/overlay/etc/entrypoint.d/85-others.sh
+++ b/v22.04/overlay/etc/entrypoint.d/85-others.sh
@@ -76,7 +76,8 @@ declare -x OWNCLOUD_PROXY
 [[ -z "${OWNCLOUD_PROXY}" ]] && OWNCLOUD_PROXY=""
 
 declare -x OWNCLOUD_PROXY_USERPWD
-[[ -z "${OWNCLOUD_PROXY_USERPWD}" ]] && OWNCLOUD_PROXY_USERPWD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_PROXY_USERPWD:+x}" ]] && OWNCLOUD_PROXY_USERPWD=""
 
 declare -x OWNCLOUD_TRASHBIN_RETENTION_OBLIGATION
 [[ -z "${OWNCLOUD_TRASHBIN_RETENTION_OBLIGATION}" ]] && OWNCLOUD_TRASHBIN_RETENTION_OBLIGATION=""
@@ -234,4 +235,24 @@ declare -x OWNCLOUD_IOC_SCANNER_CONFIRMATION
 declare -x OWNCLOUD_ACTIVITY_EXPIRE_DAYS
 [[ -z "${OWNCLOUD_ACTIVITY_EXPIRE_DAYS}" ]] && OWNCLOUD_ACTIVITY_EXPIRE_DAYS=""
 
+declare -x OWNCLOUD_WOPI_TOKEN_KEY
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_WOPI_TOKEN_KEY:+x}" ]] && OWNCLOUD_WOPI_TOKEN_KEY=""
+
+declare -x OWNCLOUD_WOPI_PROXY_KEY
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_WOPI_PROXY_KEY:+x}" ]] && OWNCLOUD_WOPI_PROXY_KEY=""
+
+declare -x OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER
+[[ -z "${OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER}" ]] && OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER=""
+
+declare -x OWNCLOUD_WOPI_GROUP
+[[ -z "${OWNCLOUD_WOPI_GROUP}" ]] && OWNCLOUD_WOPI_GROUP=""
+
+declare -x OWNCLOUD_WOPI_PROXY_URL
+[[ -z "${OWNCLOUD_WOPI_PROXY_URL}" ]] && OWNCLOUD_WOPI_PROXY_URL=""
+
+declare -x OWNCLOUD_WOPI_BUSINESS_FLOW_ENABLED
+[[ -z "${OWNCLOUD_WOPI_BUSINESS_FLOW_ENABLED}" ]] && OWNCLOUD_WOPI_BUSINESS_FLOW_ENABLED=""
+
 true
diff --git a/v22.04/overlay/etc/templates/config.php b/v22.04/overlay/etc/templates/config.php
index a1eb5cf..2d8d5e2 100644
--- a/v22.04/overlay/etc/templates/config.php
+++ b/v22.04/overlay/etc/templates/config.php
@@ -498,6 +498,30 @@ function getConfigFromEnv() {
     }
   }
 
+  if (getenv('OWNCLOUD_WOPI_TOKEN_KEY') != '') {
+    $config['wopi.token.key'] = getenv('OWNCLOUD_WOPI_TOKEN_KEY');
+  }
+
+  if (getenv('OWNCLOUD_WOPI_PROXY_KEY') != '') {
+    $config['wopi.proxy.key'] = getenv('OWNCLOUD_WOPI_PROXY_KEY');
+  }
+
+  if (getenv('OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER') != '') {
+    $config['wopi.office-online.server'] = getenv('OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER');
+  }
+
+  if (getenv('OWNCLOUD_WOPI_GROUP') != '') {
+    $config['wopi_group'] = getenv('OWNCLOUD_WOPI_GROUP');
+  }
+
+  if (getenv('OWNCLOUD_WOPI_PROXY_URL') != '') {
+    $config['wopi.proxy.url'] = getenv('OWNCLOUD_WOPI_PROXY_URL');
+  }
+
+  if (getenv('OWNCLOUD_WOPI_BUSINESS_FLOW_ENABLED') != '') {
+    $config['wopi.business-flow.enabled'] = getenv('OWNCLOUD_WOPI_BUSINESS_FLOW_ENABLED');
+  }
+
   switch (true) {
     case getenv('OWNCLOUD_REDIS_ENABLED') && getenv('OWNCLOUD_REDIS_ENABLED') === 'true':
       $config = array_merge_recursive($config, [
diff --git a/v24.04/overlay/etc/entrypoint.d/85-others.sh b/v24.04/overlay/etc/entrypoint.d/85-others.sh
index db5ab13..542ded0 100755
--- a/v24.04/overlay/etc/entrypoint.d/85-others.sh
+++ b/v24.04/overlay/etc/entrypoint.d/85-others.sh
@@ -85,7 +85,8 @@ declare -x OWNCLOUD_PROXY
 [[ -z "${OWNCLOUD_PROXY}" ]] && OWNCLOUD_PROXY=""
 
 declare -x OWNCLOUD_PROXY_USERPWD
-[[ -z "${OWNCLOUD_PROXY_USERPWD}" ]] && OWNCLOUD_PROXY_USERPWD=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_PROXY_USERPWD:+x}" ]] && OWNCLOUD_PROXY_USERPWD=""
 
 declare -x OWNCLOUD_PROXY_IGNORE
 [[ -z "${OWNCLOUD_PROXY_IGNORE}" ]] && OWNCLOUD_PROXY_IGNORE=""
@@ -334,7 +335,8 @@ declare -x OWNCLOUD_USER_LDAP_ENABLE_MEDIAL_SEARCH
 [[ -z "${OWNCLOUD_USER_LDAP_ENABLE_MEDIAL_SEARCH}" ]] && OWNCLOUD_USER_LDAP_ENABLE_MEDIAL_SEARCH=""
 
 declare -x OWNCLOUD_METRICS_SHARED_SECRET
-[[ -z "${OWNCLOUD_METRICS_SHARED_SECRET}" ]] && OWNCLOUD_METRICS_SHARED_SECRET=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_METRICS_SHARED_SECRET:+x}" ]] && OWNCLOUD_METRICS_SHARED_SECRET=""
 
 declare -x OWNCLOUD_COLLABORA_GROUP
 [[ -z "${OWNCLOUD_COLLABORA_GROUP}" ]] && OWNCLOUD_COLLABORA_GROUP=""
@@ -343,7 +345,12 @@ declare -x OWNCLOUD_WORKFLOW_RETENTION_ENGINE
 [[ -z "${OWNCLOUD_WORKFLOW_RETENTION_ENGINE}" ]] && OWNCLOUD_WORKFLOW_RETENTION_ENGINE=""
 
 declare -x OWNCLOUD_WOPI_TOKEN_KEY
-[[ -z "${OWNCLOUD_WOPI_TOKEN_KEY}" ]] && OWNCLOUD_WOPI_TOKEN_KEY=""
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_WOPI_TOKEN_KEY:+x}" ]] && OWNCLOUD_WOPI_TOKEN_KEY=""
+
+declare -x OWNCLOUD_WOPI_PROXY_KEY
+# ":+x" keeps the value out of the xtrace output when DEBUG=true
+[[ -z "${OWNCLOUD_WOPI_PROXY_KEY:+x}" ]] && OWNCLOUD_WOPI_PROXY_KEY=""
 
 declare -x OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER
 [[ -z "${OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER}" ]] && OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER=""
diff --git a/v24.04/overlay/etc/templates/config.php b/v24.04/overlay/etc/templates/config.php
index bc54b4b..07da804 100644
--- a/v24.04/overlay/etc/templates/config.php
+++ b/v24.04/overlay/etc/templates/config.php
@@ -714,6 +714,10 @@ function getConfigFromEnv() {
     $config['wopi.token.key'] = getenv('OWNCLOUD_WOPI_TOKEN_KEY');
   }
 
+  if (getenv('OWNCLOUD_WOPI_PROXY_KEY') != '') {
+    $config['wopi.proxy.key'] = getenv('OWNCLOUD_WOPI_PROXY_KEY');
+  }
+
   if (getenv('OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER') != '') {
     $config['wopi.office-online.server'] = getenv('OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER');
   }