diff --git a/README.md b/README.md
index 1009617d8..515e7cf97 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,9 @@ FROM icr.io/appcafe/websphere-liberty:kernel-java17-openj9-ubi
 # Default setting for the verbose option. Set it to true to debug the application container image build failures
 ARG VERBOSE=false
 
+# HTTP port (9080) is disabled by default and HTTPS (9443) remains enabled. Uncomment and set to true to re-enable plain HTTP.
+#ARG HTTP_ENDPOINT=true
+
 # Add Liberty server configuration including all necessary features
 COPY --chown=1001:0  server.xml /config/
 
@@ -86,15 +89,15 @@ This section describes the optional build variables that can be enabled via the
   * Description: Automatically generates a secure random password for LTPA keys and exports it as the `ltpa_keys_password` environment variable. This prevents the LTPA service from failing with error `CWWKS4118E` when no LTPA keys password is configured.
   * Default: `"true"`.
   * Note: If `ltpa_keys_password` is already set, automatic generation is skipped. Set to `"false"` to disable.
+* `HTTP_ENDPOINT`
+  *  Description: Add configuration properties for an HTTP endpoint. By default, the HTTP port is disabled (`-1`) and HTTPS remains enabled as the expected transport. Set `HTTP_ENDPOINT=true` to re-enable plain HTTP (port 9080 by default).
+  *  XML Snippet Location: [http-ssl-endpoint.xml](ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml) when SSL is enabled. Otherwise [http-endpoint.xml](ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml)
 
 
 ### Deprecated Build Variables
 
 The following container image build variables are now **deprecated** and will be **removed** in a future release. You should **stop** using them:
 
-* `HTTP_ENDPOINT`
-  *  Description: Add configuration properties for an HTTP endpoint.
-  *  XML Snippet Location: [http-ssl-endpoint.xml](ga/latest/kernel/helpers/build/configuration_snippets/http-ssl-endpoint.xml) when SSL is enabled. Otherwise [http-endpoint.xml](ga/latest/kernel/helpers/build/configuration_snippets/http-endpoint.xml)
 * `MP_HEALTH_CHECK`
   *  Description: Check the health of the environment using Liberty feature `mpHealth-1.0` (implements [MicroProfile Health](https://microprofile.io/project/eclipse/microprofile-health)).
   *  XML Snippet Location: [mp-health-check.xml](ga/latest/kernel/helpers/build/configuration_snippets/mp-health-check.xml)
@@ -146,13 +149,13 @@ This feature can be controlled via the following variables:
   * Default: `"true"`.
 * `WARM_ENDPOINT_URL` (enviornment variable)
   * Description: The URL to access during SCC population if WARM_ENDPOINT is true.
-  * Default: `"localhost:9080/"`.
+  * Default: `"https://localhost:9443/"`.
 * `WARM_OPENAPI_ENDPOINT` (environment variable)
   * Description: (24.0.0.4+) If `"true"`, curl will be used to access the WARM_OPENAPI_ENDPOINT_URL (see below) during the population of the SCC. This will increase the amount of information in the SCC and improve first request time in subsequent starts of the image.
   * Default: `"true"`
 * `WARM_OPENAPI_ENDPOINT_URL` (enviornment variable)
   * Description: (24.0.0.4+) The URL to access during SCC population if WARM_OPENAPI_ENDPOINT is true.
-  * Default: `"localhost:9080/openapi"`
+  * Default: `"https://localhost:9443/openapi"`
 
 ## Logging
 
diff --git a/ga/latest/kernel/Dockerfile.ubi.ibmjava8 b/ga/latest/kernel/Dockerfile.ubi.ibmjava8
index 8997224e5..a80f05870 100644
--- a/ga/latest/kernel/Dockerfile.ubi.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubi.ibmjava8
@@ -178,7 +178,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk11 b/ga/latest/kernel/Dockerfile.ubi.openjdk11
index 23e3d4f98..ceda338ac 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk11
@@ -180,7 +180,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk17 b/ga/latest/kernel/Dockerfile.ubi.openjdk17
index d0175b0e6..f49e08e46 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk17
@@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi.openjdk8 b/ga/latest/kernel/Dockerfile.ubi.openjdk8
index ea065b4cc..27d1a9ff1 100644
--- a/ga/latest/kernel/Dockerfile.ubi.openjdk8
+++ b/ga/latest/kernel/Dockerfile.ubi.openjdk8
@@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8 b/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
index d86da65b0..1d66e75f6 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.ibmjava8
@@ -192,7 +192,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
index cd88363bb..61cb34dbe 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk11
@@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
index f8fbbc094..0f25914ee 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk17
@@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
index 5818627b9..75250af15 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk21
@@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
index b5a71c379..e650bf03f 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk25
@@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8 b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
index 9f6a02b36..821cf7fde 100644
--- a/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
+++ b/ga/latest/kernel/Dockerfile.ubi10-minimal.openjdk8
@@ -179,7 +179,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8 b/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
index 0a87a63b7..4573f53f3 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
+++ b/ga/latest/kernel/Dockerfile.ubuntu.ibmjava8
@@ -159,7 +159,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.openjdk11 b/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
index cd6650ad4..b37267946 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
+++ b/ga/latest/kernel/Dockerfile.ubuntu.openjdk11
@@ -154,7 +154,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/Dockerfile.ubuntu.openjdk17 b/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
index ba4a34857..2bbbb7c4f 100644
--- a/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
+++ b/ga/latest/kernel/Dockerfile.ubuntu.openjdk17
@@ -154,7 +154,7 @@ ENV RANDFILE=/tmp/.rnd \
 
 USER 1001
 
-EXPOSE 9080 9443
+EXPOSE 9443
 
 ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
 CMD ["/opt/ibm/wlp/bin/server", "run", "defaultServer"]
diff --git a/ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml b/ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml
new file mode 100644
index 000000000..b97391b58
--- /dev/null
+++ b/ga/latest/kernel/helpers/build/configuration_snippets/config-mbean.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<server>
+    <!-- Disable automatic configuration file monitoring.
+         The server will not reload config after startup; a restart is required to apply changes. -->
+    <config updateTrigger="disabled" />
+</server>
diff --git a/ga/latest/kernel/helpers/build/configure.sh b/ga/latest/kernel/helpers/build/configure.sh
index a1ed20628..fa3d6461a 100755
--- a/ga/latest/kernel/helpers/build/configure.sh
+++ b/ga/latest/kernel/helpers/build/configure.sh
@@ -36,16 +36,30 @@ function main() {
   mkdir -p ${SNIPPETS_TARGET}
   mkdir -p ${SNIPPETS_TARGET_DEFAULTS}
 
+  # Disable automatic configuration file monitoring (security hardening)
+  cp $SNIPPETS_SOURCE/config-mbean.xml $SNIPPETS_TARGET/config-mbean.xml
+  chmod g+rw $SNIPPETS_TARGET/config-mbean.xml
+
+  # HTTP Endpoint
+  if [ "$HTTP_ENDPOINT" == "true" ]; then
+    if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
+      cp $SNIPPETS_SOURCE/http-ssl-endpoint.xml $SNIPPETS_TARGET/http-ssl-endpoint.xml
+    else
+      cp $SNIPPETS_SOURCE/http-endpoint.xml $SNIPPETS_TARGET/http-endpoint.xml
+    fi
+  else
+    # Disable default HTTP port, HTTPS remains enabled
+    if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
+      sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' $SNIPPETS_SOURCE/http-ssl-endpoint.xml \
+        > $SNIPPETS_TARGET/http-ssl-endpoint.xml
+    else
+      sed 's/httpPort="\${HTTP_PORT}"/httpPort="-1"/' $SNIPPETS_SOURCE/http-endpoint.xml \
+        > $SNIPPETS_TARGET/http-endpoint.xml
+    fi
+  fi
+
   # Check for each Liberty value-add functionality
   if [ "$FEATURES_INSTALLED" == "false" ]; then
-    # HTTP Endpoint
-    if [ "$HTTP_ENDPOINT" == "true" ]; then
-      if [ "$SSL" == "true" ] || [ "$TLS" == "true" ]; then
-        cp $SNIPPETS_SOURCE/http-ssl-endpoint.xml $SNIPPETS_TARGET/http-ssl-endpoint.xml
-      else
-        cp $SNIPPETS_SOURCE/http-endpoint.xml $SNIPPETS_TARGET/http-endpoint.xml
-      fi
-    fi
 
     # MicroProfile Health
     if [ "$MP_HEALTH_CHECK" == "true" ]; then
diff --git a/ga/latest/kernel/helpers/build/features.sh b/ga/latest/kernel/helpers/build/features.sh
index 2773c5066..8ae733278 100755
--- a/ga/latest/kernel/helpers/build/features.sh
+++ b/ga/latest/kernel/helpers/build/features.sh
@@ -43,4 +43,7 @@ fi
 featureUtility installServerFeatures --acceptLicense defaultServer --noCache
 find /opt/ibm/wlp/lib /opt/ibm/wlp/bin ! -perm -g=rw -print0 | xargs -0 -r chmod g+rw
 
+# Validate the Liberty installation integrity after feature installation
+/opt/ibm/wlp/bin/productInfo validate
+
 echo "features.sh script has been run" > /logs/features.log
diff --git a/ga/latest/kernel/helpers/build/populate_scc.sh b/ga/latest/kernel/helpers/build/populate_scc.sh
index 0013505ae..97eb54efa 100755
--- a/ga/latest/kernel/helpers/build/populate_scc.sh
+++ b/ga/latest/kernel/helpers/build/populate_scc.sh
@@ -23,9 +23,9 @@ SCC_SIZE="80m"  # Default size of the SCC layer.
 ITERATIONS=2    # Number of iterations to run to populate it.
 TRIM_SCC=yes    # Trim the SCC to eliminate any wasted space.
 WARM_ENDPOINT=true
-WARM_ENDPOINT_URL=localhost:9080/
+WARM_ENDPOINT_URL=https://localhost:9443/
 WARM_OPENAPI_ENDPOINT=true
-WARM_OPENAPI_ENDPOINT_URL=localhost:9080/openapi
+WARM_OPENAPI_ENDPOINT_URL=https://localhost:9443/openapi
 
 # If this directory exists and has at least ug=rwx permissions, assume the base image includes an SCC called 'openj9_system_scc' and build on it.
 # If not, build on our own SCC.
@@ -128,11 +128,11 @@ then
 
   if [ ${WARM_ENDPOINT} == true ]
   then
-    curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
+    curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
   fi
   if [ ${WARM_OPENAPI_ENDPOINT} == true ]
   then
-    curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
+    curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
   fi
 
   /opt/ibm/wlp/bin/server stop
@@ -163,11 +163,11 @@ do
 
   if [ ${WARM_ENDPOINT} == true ]
   then
-    curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
+    curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_ENDPOINT_URL} 2>&1 || echo "${WARM_ENDPOINT_URL} call failed, continuing"
   fi
   if [ ${WARM_OPENAPI_ENDPOINT} == true ]
   then
-    curl --silent --output /dev/null --show-error --fail --max-time 5 ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
+    curl --silent --output /dev/null --show-error --fail --max-time 5 --insecure ${WARM_OPENAPI_ENDPOINT_URL} 2>&1 || echo "${WARM_OPENAPI_ENDPOINT_URL} call failed, continuing"
   fi
 
   /opt/ibm/wlp/bin/server stop