diff --git a/roles/cifmw_cephadm/tasks/bootstrap.yml b/roles/cifmw_cephadm/tasks/bootstrap.yml
index 9ac56bfffe..270993a19c 100644
--- a/roles/cifmw_cephadm/tasks/bootstrap.yml
+++ b/roles/cifmw_cephadm/tasks/bootstrap.yml
@@ -50,6 +50,10 @@
     - name: Run cephadm bootstrap
       become: true
       register: cephadm_bootstrap
+      vars:
+        _container_registry_url: "{{ cifmw_cephadm_registry_url|default(cifmw_registry_token_registry_url|default(''), True) }}"
+        _container_registry_username: "{{ cifmw_cephadm_registry_username|default(cifmw_registry_token.credentials.username|default(''), True) }}"
+        _container_registry_password: "{{ cifmw_cephadm_registry_password|default(cifmw_registry_token.credentials.password|default(''), True) }}"
       ansible.builtin.shell: |
         {{ cifmw_cephadm_bin }} \
         {% if not cifmw_cephadm_default_container %}--image {{ cifmw_cephadm_container_ns + '/' + cifmw_cephadm_container_image + ':' + cifmw_cephadm_container_tag|string }} \{% endif %}
@@ -65,9 +69,9 @@
         --output-keyring {{ cifmw_cephadm_admin_keyring }} \
         --output-config {{ cifmw_cephadm_conf }} \
         --fsid {{ cifmw_cephadm_fsid }} \
-        {% if cifmw_cephadm_registry_url|length > 0 %}--registry-url {{ cifmw_cephadm_registry_url }} \{% endif %}
-        {% if cifmw_cephadm_registry_username|length > 0 %}--registry-username {{ cifmw_cephadm_registry_username }} \{% endif %}
-        {% if cifmw_cephadm_registry_password|length > 0 %}--registry-password {{ cifmw_cephadm_registry_password }} \{% endif %}
+        {% if _container_registry_url|length > 0 %}--registry-url {{ _container_registry_url }} \{% endif %}
+        {% if _container_registry_username|length > 0 %}--registry-username {{ _container_registry_username|quote }} \{% endif %}
+        {% if _container_registry_password|length > 0 %}--registry-password {{ _container_registry_password|quote }} \{% endif %}
         {% if cifmw_cephadm_spec_on_bootstrap %}--apply-spec {{ cifmw_cephadm_spec }} \{% endif %}
         {% if cifmw_cephadm_assimilate_conf_stat.stat.exists %}--config {{ cifmw_cephadm_assimilate_conf }} \{% endif %}
         {% if cifmw_cephadm_single_host_defaults %}--single-host-defaults \{% endif %}
@@ -78,7 +82,11 @@
     - name: Show results of bootstrap
       when: cifmw_cephadm_verbose | bool
       ansible.builtin.debug:
-        msg: "{{ cephadm_bootstrap }}"
+        msg: >-
+          {{
+            cephadm_bootstrap
+            | to_yaml | regex_replace("(--registry-[^\s]+)\s+(['\"])(.+?)\2", "\1 \2<REDACTED>\2")
+          }}
 
     - name: Ensure cifmw_cephadm_ceph_cli is set
       when: