diff --git a/ct/homeassistant.sh b/ct/homeassistant.sh
index 7d30d82e4..68e59eaa3 100644
--- a/ct/homeassistant.sh
+++ b/ct/homeassistant.sh
@@ -70,32 +70,7 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "4" ]; then
-    msg_info "Installing FileBrowser"
-    RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g')
-    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    service_path="/etc/systemd/system/filebrowser.service"
-    echo "[Unit]
-Description=Filebrowser
-After=network-online.target
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-[Install]
-WantedBy=default.target" >$service_path
-
-    $STD systemctl enable --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
     exit
   fi
 }
diff --git a/ct/podman-homeassistant.sh b/ct/podman-homeassistant.sh
index a3a569dab..552fc2393 100644
--- a/ct/podman-homeassistant.sh
+++ b/ct/podman-homeassistant.sh
@@ -66,33 +66,7 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "3" ]; then
-    msg_info "Installing FileBrowser"
-    $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    cat <<EOF >/etc/systemd/system/filebrowser.service
-[Unit]
-Description=Filebrowser
-After=network-online.target
-
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-
-[Install]
-WantedBy=default.target
-EOF
-    systemctl enable -q --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
     exit
   fi
   if [ "$UPD" == "4" ]; then
diff --git a/tools/addon/filebrowser-quantum.sh b/tools/addon/filebrowser-quantum.sh
index 6db8e401b..97737bb0e 100644
--- a/tools/addon/filebrowser-quantum.sh
+++ b/tools/addon/filebrowser-quantum.sh
@@ -140,6 +140,23 @@ if [[ -f "$INSTALL_PATH" ]]; then
   echo -n "${TAB}Update ${APP}? (y/N): "
   read -r update_prompt
   if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then
+    # Older installs kept the public password in the config, which resets it on every start
+    if grep -qE '^\s*adminPassword:\s*"?community-scripts\.org"?\s*$' "$CONFIG_PATH" 2>/dev/null; then
+      msg_info "Replacing the default admin password"
+      ADMIN_PASS=$(random_password 20)
+      sed -i -E "s|^(\s*adminPassword:).*|\1 ${ADMIN_PASS}|" "$CONFIG_PATH"
+      chmod 600 "$CONFIG_PATH"
+      if [[ "$OS" == "Debian" ]]; then systemctl restart filebrowser.service; else rc-service filebrowser restart &>/dev/null; fi
+      fq_port=$(awk '/^http:/{h=1} h && /^  port:/{print $2; exit}' "$CONFIG_PATH")
+      for _ in {1..30}; do
+        [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${fq_port:-8080}/health")" == "200" ]] && break
+        sleep 1
+      done
+      sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
+      echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
+      chmod 600 ~/filebrowser-quantum.creds
+      msg_ok "Replaced the default admin password (saved in ~/filebrowser-quantum.creds)"
+    fi
     if check_for_gh_release "filebrowser-quantum" "gtsteffaniak/filebrowser"; then
       msg_info "Updating ${APP}"
       if ! command -v curl &>/dev/null; then $STD $PKG_MANAGER curl; fi
@@ -189,6 +206,8 @@ chown root:root /usr/local/community-scripts
 chmod 755 /usr/local/community-scripts
 msg_ok "Directory prepared"
 
+ADMIN_PASS=$(random_password 20)
+msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
 echo -n "${TAB}Use No Authentication? (y/N): "
 read -r noauth_prompt
 
@@ -234,9 +253,12 @@ server:
           - neverWatchPath: "/lost+found"
 auth:
   adminUsername: admin
-  adminPassword: community-scripts.org
+  adminPassword: ${ADMIN_PASS}
 EOF
-  msg_ok "Configured with default admin (admin / community-scripts.org)"
+  chmod 600 "$CONFIG_PATH"
+  echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
+  chmod 600 ~/filebrowser-quantum.creds
+  msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)"
 fi
 
 msg_info "Creating service"
@@ -276,4 +298,13 @@ EOF
 fi
 
 msg_ok "Service created successfully"
+
+# auth.adminPassword resets the password on every start, so it stays only until the admin exists
+if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then
+  for _ in {1..30}; do
+    [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break
+    sleep 1
+  done
+  sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
+fi
 msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}"
diff --git a/tools/addon/filebrowser.sh b/tools/addon/filebrowser.sh
index 9f54ea311..cd4399a96 100644
--- a/tools/addon/filebrowser.sh
+++ b/tools/addon/filebrowser.sh
@@ -87,6 +87,20 @@ if [ -f "$INSTALL_PATH" ]; then
 
   read -r -p "Would you like to update ${APP}? (y/N): " update_prompt
   if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then
+    # Older installs created admin with the public password community-scripts.org
+    fb_port=$(grep -oP '(?<=-p )[0-9]+' "$SERVICE_PATH" 2>/dev/null | head -n1)
+    fb_db=$(grep -oP '(?<=-d )\S+' "$SERVICE_PATH" 2>/dev/null | head -n1)
+    [[ -n "$fb_db" ]] || fb_db="$(grep -oP '(?<=^WorkingDirectory=)\S+' "$SERVICE_PATH" 2>/dev/null || echo /root)/filebrowser.db"
+    if [[ "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d '{"username":"admin","password":"community-scripts.org","recaptcha":""}' "http://127.0.0.1:${fb_port:-8080}/api/login")" == "200" ]]; then
+      msg_info "Replacing the default admin password"
+      ADMIN_PASS=$(random_password 20)
+      if [[ "$OS" == "Debian" ]]; then systemctl stop filebrowser; else rc-service filebrowser stop &>/dev/null; fi
+      $STD filebrowser users update admin --password "$ADMIN_PASS" --database "$fb_db"
+      if [[ "$OS" == "Debian" ]]; then systemctl start filebrowser; else rc-service filebrowser start &>/dev/null; fi
+      echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds
+      chmod 600 ~/filebrowser.creds
+      msg_ok "Replaced the default admin password (saved in ~/filebrowser.creds)"
+    fi
     if check_for_gh_release "filebrowser" "filebrowser/filebrowser"; then
       msg_info "Updating ${APP}"
       fetch_and_deploy_gh_release "filebrowser" "filebrowser/filebrowser" "prebuild" "latest" "/opt/filebrowser-dist" "linux-$(arch_resolve)-filebrowser.tar.gz"
@@ -125,6 +139,8 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
   chmod 644 "$DB_PATH"
   msg_ok "Directory created successfully"
 
+  ADMIN_PASS=$(random_password 20)
+  msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
   read -r -p "Would you like to use No Authentication? (y/N): " auth_prompt
   if [[ "${auth_prompt,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Configuring No Authentication"
@@ -133,16 +149,18 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
     $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
     $STD filebrowser config set --auth.method=noauth --database "$DB_PATH"
     if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then
-      $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
+      $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
     fi
     msg_ok "No Authentication configured"
   else
-    msg_info "Setting up default authentication"
+    msg_info "Setting up authentication"
     cd /usr/local/community-scripts
     $STD filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
     $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
-    $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
-    msg_ok "Default authentication configured (admin:community-scripts.org)"
+    $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
+    echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds
+    chmod 600 ~/filebrowser.creds
+    msg_ok "Authentication configured (credentials saved in ~/filebrowser.creds)"
   fi
 
   msg_info "Creating service"
@@ -156,7 +174,6 @@ After=network-online.target
 User=root
 WorkingDirectory=/usr/local/community-scripts
 ExecStartPre=/bin/touch /usr/local/community-scripts/filebrowser.db
-ExecStartPre=/usr/local/bin/filebrowser config set -a "0.0.0.0" -p ${PORT} -d /usr/local/community-scripts/filebrowser.db
 ExecStart=/usr/local/bin/filebrowser -r / -d /usr/local/community-scripts/filebrowser.db -p ${PORT}
 Restart=always