diff --git a/blueprints/shopware/docker-compose.yml b/blueprints/shopware/docker-compose.yml
index cbb518d7..95d5b101 100644
--- a/blueprints/shopware/docker-compose.yml
+++ b/blueprints/shopware/docker-compose.yml
@@ -110,7 +110,7 @@ services:
       <<: *shopware-env
       COMPOSER_ALLOW_SUPERUSER: "1"
       COMPOSER_HOME: "/tmp/composer"
-      SHOPWARE_VERSION: "${SHOPWARE_VERSION:-6.7.8.2}"
+      SHOPWARE_VERSION: "${SHOPWARE_VERSION:-6.7.12.1}"
       SHOPWARE_DOCKER_VERSION: "${SHOPWARE_DOCKER_VERSION:-0.3.0}"
       ENABLE_DEMO_DATA: "${ENABLE_DEMO_DATA:-1}"
       DEMO_DATA_VERSION: "${DEMO_DATA_VERSION:-2.1.0}"
@@ -148,6 +148,10 @@ services:
 
         tmp_dir="$$(mktemp -d)"
 
+        # Composer >=2.9 refuses to install pinned versions that are affected by
+        # security advisories published later. Keep the pinned bootstrap deterministic.
+        composer config -g audit.block-insecure false 2>/dev/null || true
+
         composer create-project --no-interaction --prefer-dist "shopware/production:${SHOPWARE_VERSION}" "$$tmp_dir"
         cd "$$tmp_dir"
         composer require --no-interaction "shopware/docker:${SHOPWARE_DOCKER_VERSION}"
diff --git a/blueprints/shopware/template.toml b/blueprints/shopware/template.toml
index b93259c7..487f82dc 100644
--- a/blueprints/shopware/template.toml
+++ b/blueprints/shopware/template.toml
@@ -1,6 +1,6 @@
 [variables]
 main_domain = "${domain}"
-app_url = "https://${main_domain}"
+app_url = "http://${main_domain}"
 app_secret = "${hash:64}"
 instance_id = "${hash:32}"
 database_name = "shopware"
@@ -13,7 +13,7 @@ lock_dsn = "redis://:${redis_password}@redis:6379/1"
 php_session_save_path = "tcp://redis:6379?auth=${redis_password}"
 install_admin_username = "admin"
 install_admin_password = "${password:20}"
-shopware_version = "6.7.8.2"
+shopware_version = "6.7.12.1"
 shopware_docker_version = "0.3.0"
 shopware_cli_image = "shopware/shopware-cli:0.14.3-php-8.4"
 shopware_base_image = "shopware/docker-base:8.4.19-nginx"