diff --git a/.gitignore b/.gitignore
index ede9d588..72453241 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,8 @@
 /.idea
 /build
 */build
+/bin
+*/bin
 */out
 *.ipr
 *.iml
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4e9a576e..4af01f80 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+## Unreleased
+
+* **Security Fix**: External extension directory loading is now disabled by default to prevent arbitrary code execution vulnerability. To enable extension loading from external directories, set environment variable `RD_EXT_DISABLED=false`. (Addresses RUN-3540)
+
+
 ## 2.0.9
 
 * fix: NPE if system info does not return all data
diff --git a/dockers/install/upgrade-rpm/Dockerfile b/dockers/install/upgrade-rpm/Dockerfile
index 777bfae1..fd6e4be6 100644
--- a/dockers/install/upgrade-rpm/Dockerfile
+++ b/dockers/install/upgrade-rpm/Dockerfile
@@ -7,6 +7,7 @@ RUN which java
 RUN curl https://raw.githubusercontent.com/rundeck/packaging/main/scripts/rpm-setup.sh 2> /dev/null | bash -s rundeck
 RUN sed -i.bak s/gpgcheck=0/gpgcheck=1/ /etc/yum.repos.d/rundeck.repo
 RUN rpm --import https://raw.githubusercontent.com/rundeck/packaging/main/pubring.gpg
+RUN rpm --import https://raw.githubusercontent.com/rundeck/packaging/main/pubring20250228.gpg
 RUN rpm --import https://docs.rundeck.com/keys/BUILD-GPG-KEY-20230105.key
 
 RUN yum -y install rundeck-cli
diff --git a/packaging b/packaging
index 8077ed34..662b44a7 160000
--- a/packaging
+++ b/packaging
@@ -1 +1 @@
-Subproject commit 8077ed34131de99217a3c1a1bd5545f6975c4f3a
+Subproject commit 662b44a7975888008c8c5b5553e96ecb2293e1d3
diff --git a/rd-cli-tool/src/main/java/org/rundeck/client/tool/Main.java b/rd-cli-tool/src/main/java/org/rundeck/client/tool/Main.java
index db1f6cf9..f008f4a8 100644
--- a/rd-cli-tool/src/main/java/org/rundeck/client/tool/Main.java
+++ b/rd-cli-tool/src/main/java/org/rundeck/client/tool/Main.java
@@ -196,7 +196,7 @@ private static ConfigSource buildConfig() {
     }
 
     private static void loadExtensionJars(ConfigSource config) {
-        if (config.getBool(RD_EXT_DISABLED, false)) {
+        if (config.getBool(RD_EXT_DISABLED, true)) {
             return;
         }
         String rd_ext_dir = config.get(RD_EXT_DIR);