diff --git a/Dockerfile b/Dockerfile
index 4a8a3002..2d4ebe37 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,28 +22,35 @@ COPY --chmod=644 files/sudoers* /etc/sudoers.d
 
 EXPOSE 25565
 
-ARG EASY_ADD_VER=0.8.1
-ADD https://github.com/itzg/easy-add/releases/download/${EASY_ADD_VER}/easy-add_${TARGETOS}_${TARGETARCH}${TARGETVARIANT} /usr/bin/easy-add
+ARG APPS_REV=1
+ARG GITHUB_BASEURL=https://github.com
+
+ARG EASY_ADD_VERSION=0.8.2
+ADD ${GITHUB_BASEURL}/itzg/easy-add/releases/download/${EASY_ADD_VERSION}/easy-add_${TARGETOS}_${TARGETARCH}${TARGETVARIANT} /usr/bin/easy-add
 RUN chmod +x /usr/bin/easy-add
 
+ARG RESTIFY_VERSION=1.7.1
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
-  --var version=1.7.1 --var app=restify --file {{.app}} \
-  --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
+  --var version=${RESTIFY_VERSION} --var app=restify --file {{.app}} \
+  --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
+ARG RCON_CLI_VERSION=1.6.4
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
-  --var version=1.6.3 --var app=rcon-cli --file {{.app}} \
-  --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
+  --var version=${RCON_CLI_VERSION} --var app=rcon-cli --file {{.app}} \
+  --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
+ARG MC_MONITOR_VERSION=0.12.6
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
-  --var version=0.12.5 --var app=mc-monitor --file {{.app}} \
-  --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
+  --var version=${MC_MONITOR_VERSION} --var app=mc-monitor --file {{.app}} \
+  --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
+ARG MC_SERVER_RUNNER_VERSION=1.9.1
 RUN easy-add --var os=${TARGETOS} --var arch=${TARGETARCH}${TARGETVARIANT} \
-  --var version=1.9.1 --var app=mc-server-runner --file {{.app}} \
-  --from https://github.com/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
+  --var version=${MC_SERVER_RUNNER_VERSION} --var app=mc-server-runner --file {{.app}} \
+  --from ${GITHUB_BASEURL}/itzg/{{.app}}/releases/download/{{.version}}/{{.app}}_{{.version}}_{{.os}}_{{.arch}}.tar.gz
 
 ARG MC_HELPER_VERSION=1.36.12
-ARG MC_HELPER_BASE_URL=https://github.com/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
+ARG MC_HELPER_BASE_URL=${GITHUB_BASEURL}/itzg/mc-image-helper/releases/download/${MC_HELPER_VERSION}
 # used for cache busting local copy of mc-image-helper
 ARG MC_HELPER_REV=1
 RUN curl -fsSL ${MC_HELPER_BASE_URL}/mc-image-helper-${MC_HELPER_VERSION}.tgz \
diff --git a/notes/start-script-flow.drawio.png b/notes/start-script-flow.drawio.png
index ec120ac1..22eca87a 100644
Binary files a/notes/start-script-flow.drawio.png and b/notes/start-script-flow.drawio.png differ
diff --git a/scripts/start b/scripts/start
index 206eeb1f..9f40064a 100755
--- a/scripts/start
+++ b/scripts/start
@@ -9,18 +9,13 @@
 
 umask 0002
 
-if isTrue "${ENABLE_RCON:-true}" && ! [ -v RCON_PASSWORD ] && ! [ -v RCON_PASSWORD_FILE ]; then
-  RCON_PASSWORD=$(openssl rand -hex 12)
-  export RCON_PASSWORD
-fi
+# Remove from previous run and do this as elevated user since file used to be created before demoting
+rm -f "$HOME/.rcon-cli.env"
 
 if ! isTrue "${SKIP_SUDO:-false}" && [ "$(id -u)" = 0 ]; then
   runAsUser=minecraft
   runAsGroup=minecraft
 
-  # For rcon-cli access running via exec, which by default is running as root
-  echo "password=${RCON_PASSWORD}" > "$HOME/.rcon-cli.env"
-
   if [[ -v UID ]]; then
     if [[ $UID != 0 ]]; then
       if [[ $UID != $(id -u minecraft) ]]; then
diff --git a/scripts/start-configuration b/scripts/start-configuration
index 1ce3cef4..926b68fa 100755
--- a/scripts/start-configuration
+++ b/scripts/start-configuration
@@ -15,11 +15,9 @@ IFS=$'\n\t'
 : "${RCON_CMDS_FIRST_CONNECT:=}"
 : "${RCON_CMDS_LAST_DISCONNECT:=}"
 : "${RCON_CMDS_PERIOD:=10}"
-: "${RCON_PASSWORD_FILE:=}"
 : "${ENABLE_RCON:=true}"
-: "${RCON_PASSWORD:=minecraft}"
 : "${RCON_PORT:=25575}"
-export ENABLE_RCON RCON_PASSWORD RCON_PORT
+export ENABLE_RCON RCON_PORT
 
 : "${MEMORY=1G}"
 : "${INIT_MEMORY=${MEMORY}}"
@@ -49,6 +47,36 @@ if [ ! -e /data/eula.txt ]; then
   writeEula
 fi
 
+##########################################
+# Setup RCON password
+
+if isTrue "${ENABLE_RCON:-true}" && ! [[ -v RCON_PASSWORD ]] && ! [[ -v RCON_PASSWORD_FILE ]]; then
+  RCON_PASSWORD=$(openssl rand -hex 12)
+  export RCON_PASSWORD
+fi
+
+if [[ -v RCON_PASSWORD_FILE ]]; then
+    if [ ! -e "${RCON_PASSWORD_FILE}" ]; then
+      log ""
+      log "Initial RCON password file ${RCON_PASSWORD_FILE} does not seems to exist."
+      log "Please ensure your configuration."
+      log "If you are using Docker Secrets feature, please check this for further information: "
+      log " https://docs.docker.com/engine/swarm/secrets"
+      log ""
+      exit 1
+    else
+      RCON_PASSWORD=$(cat "${RCON_PASSWORD_FILE}")
+      export RCON_PASSWORD
+    fi
+fi
+
+# For rcon-cli access running via exec, which by default is running as root
+echo "password=${RCON_PASSWORD}" > "$HOME/.rcon-cli.env"
+echo "password: \"${RCON_PASSWORD}\"" > "$HOME/.rcon-cli.yaml"
+
+##########################################
+# Auto-pause/stop
+
 if isTrue "${ENABLE_AUTOPAUSE}" && isTrue "${EXEC_DIRECTLY:-false}"; then
     log "EXEC_DIRECTLY=true is incompatible with ENABLE_AUTOPAUSE=true"
     exit 1
@@ -67,25 +95,6 @@ if [[ $PROXY ]]; then
     sleep 5
 fi
 
-if [[ $RCON_PASSWORD_FILE ]]; then
-    log ""
-    if [ ! -e ${RCON_PASSWORD_FILE} ]; then
-	log "Initial RCON password file ${RCON_PASSWORD_FILE} does not seems to exist."
-	log "Please ensure your configuration."
-	log "If you are using Docker Secrets feature, please check this for further information: "
-	log " https://docs.docker.com/engine/swarm/secrets"
-	log ""
-	exit 1
-    else
-	RCON_PASSWORD=$(cat ${RCON_PASSWORD_FILE})
-	export RCON_PASSWORD
-    fi
-    log ""
-fi
-
-# For rcon-cli access
-echo "password=${RCON_PASSWORD}" > "$HOME/.rcon-cli.env"
-
 function fixJavaPath() {
   # Some Docker management UIs grab all the image declared variables and present them for configuration.
   # When upgrading images across Java versions, that creates a mismatch in PATH's expected by base image.