diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..348d296a 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64.
 The machine produces a `.vhdx` disk image using the WIC image type
 and GRUB as the bootloader. It supports Debian bullseye, bookworm
 and trixie.
+
+### Automatic cleanup of APT authentication credentials
+
+`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
+When `ISAR_APT_CREDS` is configured and
+`ISAR_APT_CLEAN_AUTH_FILES` is enabled,
+`/etc/apt/auth.conf.d/isar.conf` is appended to
+`ROOTFS_CLEAN_FILES` so APT authentication credentials are
+removed from the final image rootfs.
+To keep the auth file in the image (not recommended), set
+`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index edd4f888..4e4c987b 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
 ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
 ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
 
+# If ISAR_APT_CREDS is configured, apt auth credentials are written to
+# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from
+# image rootfs by default to avoid shipping repository credentials.
+# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
+ISAR_APT_CLEAN_AUTH_FILES ?= "1"
+
+ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
+    if d.getVar('ISAR_APT_CREDS') \
+    and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \
+    else ''}"
+
 CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
 python () {
     if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):