diff --git a/README.md b/README.md
index c345780b..545996a8 100644
--- a/README.md
+++ b/README.md
@@ -130,7 +130,7 @@ chmod +x run-local.sh
 | `SPRING_PROFILES_ACTIVE` | `local` | Spring profile (`local` = H2) |
 | `SPRING_CLOUD_CONFIG_URI` | _(empty)_ | Config-server URI |
 | `SPRING_CLOUD_CONFIG_LABEL` | _(empty)_ | Config-server label / branch |
-| `loader_path_env` | `.` | Extra JARs (`-Dloader.path`, e.g. auth-adapter) |
+| `loader_path_env` | `.` | Optional extra JARs (`-Dloader.path`); auth-adapter is in the fat JAR |
 | `IMAGE` | `kernel-auditmanager-service` | Docker image name |
 | `JDK_JAVA_OPTIONS` | _(empty)_ | Extra JVM options for `docker` runs |
 
@@ -170,7 +170,7 @@ docker build -t kernel-auditmanager-service .
 
 Helm: [`helm/auditmanager/`](helm/auditmanager/). Install helper: [`deploy/install.sh`](deploy/).
 
-Runtime env (container): `active_profile_env`, `spring_config_label_env`, `spring_config_url_env`, `iam_adapter_url_env`, `loader_path_env`.
+Runtime env (container): `active_profile_env`, `spring_config_label_env`, `spring_config_url_env`, `loader_path_env` (optional extras). `kernel-auth-adapter` is bundled in the Boot fat JAR from Maven (no `configure_start.sh` / `iam_adapter_url_env` wget).
 
 ---
 
diff --git a/kernel/AGENTS.md b/kernel/AGENTS.md
index 85b5ea69..f223e116 100644
--- a/kernel/AGENTS.md
+++ b/kernel/AGENTS.md
@@ -13,7 +13,7 @@ reactor
    ├─ :8081 /v1/auditmanager
    ├─ run-local.bat|sh → init|start|smoke|stop|test|all|docker
    ├─ Swagger: relative server=${server.servlet.path} · Authorize=Authorization apiKey
-   └─ Dockerfile · loader.path · iam_adapter_url_env
+   └─ Dockerfile · auth-adapter in fat JAR (no configure_start / iam_adapter wget)
 ```
 
 ```
@@ -27,7 +27,7 @@ POST /audits → Controller → ServiceImpl → AuditHandlerImpl
 rules
 ├─ siblings omit <version> (DM in parent)
 ├─ spring-boot-jackson2 · ban kernel-bom · ban kernel-logger-logback
-├─ security: auth-adapter (prod) · TestSecurityConfig permitAll (tests)
+├─ security: auth-adapter in fat JAR · TestSecurityConfig permitAll (tests)
 ├─ db: prod=PostgreSQL ddl-auto=none · local|test=H2 schema AUDIT
 └─ jacoco=100% excl constant/config/dto/entity/exception/repository/*BootApplication
 ```
diff --git a/kernel/kernel-auditmanager-api/pom.xml b/kernel/kernel-auditmanager-api/pom.xml
index 89edacec..2673a7a0 100644
--- a/kernel/kernel-auditmanager-api/pom.xml
+++ b/kernel/kernel-auditmanager-api/pom.xml
@@ -18,7 +18,7 @@
 		AuditRequestDto / AuditRequestBuilder, AuditUtils validation, and AuditHandlerImpl
 		(persists validated events). Consume from other MOSIP services for in-process auditing,
 		or transitively via kernel-auditmanager-service. JDK 21, Spring Boot 4.1.1, no kernel-bom.
-		Depends on kernel-core 1.4.1-SNAPSHOT.
+		Depends on kernel-core.
 	</description>
 	<url>https://github.com/mosip/audit-manager</url>
 
diff --git a/kernel/kernel-auditmanager-service/Dockerfile b/kernel/kernel-auditmanager-service/Dockerfile
index 84733517..2842ace1 100644
--- a/kernel/kernel-auditmanager-service/Dockerfile
+++ b/kernel/kernel-auditmanager-service/Dockerfile
@@ -1,92 +1,77 @@
 FROM eclipse-temurin:21-jre-alpine
 
-# can be passed during Docker build as build time environment for github branch to pickup configuration from.
-ARG spring_config_label
-
-# can be passed during Docker build as build time environment for spring profiles active 
-ARG active_profile
-
-# can be passed during Docker build as build time environment for config server URL 
-ARG spring_config_url
-
-# can be passed during Docker build as build time environment for glowroot
-ARG is_glowroot
-
-# can be passed during Docker build as build time environment for artifactory URL
-ARG artifactory_url
-
-ARG loader_path
-
-# can be passed during Docker build as build time environment for github branch to pickup configuration from.
-ARG container_user=mosip
-ARG container_user_group=mosip
-ARG container_user_uid=1001
-ARG container_user_gid=1001
-
-# can be passed during Docker build as build time environment for label related addition to docker.
+# Labels assigned at Docker build time
 ARG SOURCE
 ARG COMMIT_HASH
 ARG COMMIT_ID
 ARG BUILD_TIME
-
-# environment variable to pass active profile such as DEV, QA etc at docker runtime
-ENV active_profile_env=${active_profile}
-
-# environment variable to pass github branch to pickup configuration from, at docker runtime
-ENV spring_config_label_env=${spring_config_label}
-
-# environment variable to pass spring configuration url, at docker runtime
-ENV spring_config_url_env=${spring_config_url}
-
-# environment variable to pass glowroot, at docker runtime
-ENV is_glowroot_env=${is_glowroot}
-
-# environment variable to pass artifactory url, at docker runtime
-ENV artifactory_url_env=${artifactory_url}
-
-# environment variable to pass iam_adapter url, at docker runtime
-ENV iam_adapter_url_env=${iam_adapter_url}
-
-# environment variable to pass to set workdir.
-ENV work_dir=/home/${container_user}
-
-# environment variable to pass for setting loader path
-ENV loader_path_env=${work_dir}/additional_jars/
-
-# Labels can be added to the image for metadata purposes such as source, commit hash, commit ID, and build time.
 LABEL source=${SOURCE}
 LABEL commit_hash=${COMMIT_HASH}
 LABEL commit_id=${COMMIT_ID}
 LABEL build_time=${BUILD_TIME}
 
-## install packages, create user and change permissions of file inside working dir
-RUN apk -q update \
-&& apk add -q unzip wget \
-&& addgroup -g ${container_user_gid} ${container_user_group} \
-&& adduser -s /bin/sh -u ${container_user_uid} -G ${container_user_group} -h /home/${container_user} --disabled-password ${container_user} \
-&& mkdir -p ${loader_path_env} \
-&& chown -R ${container_user}:${container_user} /home/${container_user}
+# Build-time defaults (overridable at runtime via *_env)
+ARG spring_config_label=master
+ARG active_profile=default
+ARG spring_config_url
 
-#copy the jar to container
-COPY ./target/kernel-auditmanager-service-*.jar /home/${container_user}/kernel-auditmanager-service.jar
+ARG container_user=mosip
+ARG container_user_group=mosip
+ARG container_user_uid=1001
+ARG container_user_gid=1001
 
-# set working directory for the user
-WORKDIR /home/${container_user}
+# Runtime env + workdir. loader.path kept for optional extra jars (auth-adapter is in the fat JAR from Maven).
+ENV active_profile_env=${active_profile} \
+    spring_config_label_env=${spring_config_label} \
+    spring_config_url_env=${spring_config_url} \
+    work_dir=/home/${container_user} \
+    loader_path_env=/home/${container_user}/additional_jars/
 
-COPY configure_start.sh ${work_dir}/configure_start.sh
+WORKDIR ${work_dir}
 
-# change permissions of file inside working dir
-RUN sed -i 's/\r$//' ${work_dir}/configure_start.sh \
-    && chmod +x ${work_dir}/configure_start.sh \
-    && chown -R ${container_user}:${container_user} ${work_dir}
+# Create user (no wget — kernel-auth-adapter comes from the Maven fat JAR)
+RUN apk -q update \
+    && apk add -q --no-cache bash \
+    && addgroup -g ${container_user_gid} ${container_user_group} \
+    && adduser -s /bin/sh -u ${container_user_uid} -G ${container_user_group} -h ${work_dir} --disabled-password ${container_user} \
+    && mkdir -p ${loader_path_env} \
+    && chown -R ${container_user}:${container_user} ${work_dir} \
+    && rm -rf /var/cache/apk/*
+
+# Copy built JARs (fat + optional attachments); destination must end with /
+COPY ./target/kernel-auditmanager-service-*.jar ${work_dir}/
+
+# Keep Boot fat JAR only; drop -sources / -javadoc / .original
+RUN set -eux; \
+    cd ${work_dir}; \
+    rm -f kernel-auditmanager-service-*-sources.jar \
+          kernel-auditmanager-service-*-javadoc.jar \
+          kernel-auditmanager-service-*.jar.original \
+          kernel-auditmanager-service.jar.original 2>/dev/null || true; \
+    fat=""; \
+    for f in kernel-auditmanager-service-*.jar; do \
+      [ -f "$f" ] || continue; \
+      case "$f" in \
+        *-sources.jar|*-javadoc.jar) rm -f "$f" ;; \
+        *) fat="$f" ;; \
+      esac; \
+    done; \
+    if [ -z "$fat" ] || [ ! -f "$fat" ]; then \
+      echo "error: Boot fat jar not found under ${work_dir}" >&2; \
+      ls -la "${work_dir}" >&2; \
+      exit 1; \
+    fi; \
+    mv -f "$fat" kernel-auditmanager-service.jar; \
+    chown -R ${container_user}:${container_user} ${work_dir}
 
-# select container user for all tasks
 USER ${container_user_uid}:${container_user_gid}
 
-# can expose required port
 EXPOSE 8081
 
-ENTRYPOINT ["sh", "configure_start.sh"]
-
-# the command to run when the container starts
-CMD  java -Dloader.path="${loader_path_env}" -Dspring.cloud.config.label="${spring_config_label_env}" -Dspring.profiles.active="${active_profile_env}" -Dspring.cloud.config.uri="${spring_config_url_env}" -jar kernel-auditmanager-service.jar ; \
+# JVM GC / heap: use run-local.* or Helm JDK_JAVA_OPTIONS. Shell form so ${*_env} expands at start.
+CMD java -Dfile.encoding=UTF-8 \
+    -Dloader.path="${loader_path_env}" \
+    -Dspring.cloud.config.label="${spring_config_label_env}" \
+    -Dspring.profiles.active="${active_profile_env}" \
+    -Dspring.cloud.config.uri="${spring_config_url_env}" \
+    -jar kernel-auditmanager-service.jar
diff --git a/kernel/kernel-auditmanager-service/configure_start.sh b/kernel/kernel-auditmanager-service/configure_start.sh
deleted file mode 100644
index 240963a8..00000000
--- a/kernel/kernel-auditmanager-service/configure_start.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-#installs the pre-requisites.
-set -e
-
-echo "Downloading pre-requisites install scripts"
-
-wget -q --show-progress "${iam_adapter_url_env}" -O "${loader_path_env}"/kernel-auth-adapter.jar; \
-
-echo "Installating pre-requisites completed."
-
-exec "$@"
\ No newline at end of file
diff --git a/kernel/kernel-auditmanager-service/pom.xml b/kernel/kernel-auditmanager-service/pom.xml
index 1a5e3c7d..76a033ef 100644
--- a/kernel/kernel-auditmanager-service/pom.xml
+++ b/kernel/kernel-auditmanager-service/pom.xml
@@ -17,7 +17,7 @@
 		Runnable MOSIP Audit Manager Spring Boot service. Exposes POST /v1/auditmanager/audits
 		(RequestWrapper&lt;AuditRequestDto&gt; → ResponseWrapper&lt;AuditResponseDto&gt;), validates via
 		kernel-auditmanager-api, persists to audit.app_audit_log (PostgreSQL / H2 local).
-		Auth via kernel-auth-adapter (loader.path). JDK 21, Boot 4.1.1, Cloud 2025.1.3,
+		Auth via kernel-auth-adapter (bundled in Boot fat JAR). JDK 21, Boot 4.1.1, Cloud 2025.1.3,
 		springdoc 3.1.1, Jackson 2 via spring-boot-jackson2.
 	</description>
 	<url>https://github.com/mosip/audit-manager</url>
@@ -55,8 +55,8 @@
 			<artifactId>kernel-auditmanager-api</artifactId>
 		</dependency>
 		<!--
-			kernel-auth-adapter: Token validation (Docker loader.path; openapi profile compile).
-			Exclude Boot starter to avoid conflicting autoconfig. License: MPL-2.0.
+			kernel-auth-adapter: Bearer-token validation (from Maven; in Boot fat JAR).
+			Excluded from Surefire only (stale jackson in tests). License: MPL-2.0.
 		-->
 		<dependency>
 			<groupId>io.mosip.kernel</groupId>
@@ -182,7 +182,7 @@
 				<groupId>org.springframework.boot</groupId>
 				<artifactId>spring-boot-maven-plugin</artifactId>
 				<configuration>
-					<!-- Boot 4 removed executable flag; ZIP layout supports java -jar + loader.path -->
+					<!-- Boot 4 removed executable flag; ZIP layout supports java -jar -->
 					<layout>ZIP</layout>
 				</configuration>
 				<executions>
diff --git a/kernel/kernel-auditmanager-service/src/main/java/io/mosip/kernel/auditmanager/AuditManagerBootApplication.java b/kernel/kernel-auditmanager-service/src/main/java/io/mosip/kernel/auditmanager/AuditManagerBootApplication.java
index 0df41132..16745730 100644
--- a/kernel/kernel-auditmanager-service/src/main/java/io/mosip/kernel/auditmanager/AuditManagerBootApplication.java
+++ b/kernel/kernel-auditmanager-service/src/main/java/io/mosip/kernel/auditmanager/AuditManagerBootApplication.java
@@ -11,9 +11,9 @@
  * Audit manager application.
  *
  * <p>
- * Security is provided by {@code kernel-auth-adapter} (Bearer tokens) when
- * present on the classpath / {@code loader.path}. Unused kernel-core
- * generators/validators are excluded.
+ * Security is provided by {@code kernel-auth-adapter} (Bearer tokens) on the
+ * application classpath (Maven dependency in the Boot fat JAR). Unused
+ * kernel-core generators/validators are excluded.
  * </p>
  *
  * @author Dharmesh Khandelwal
diff --git a/kernel/pom.xml b/kernel/pom.xml
index e4338b44..469386b5 100644
--- a/kernel/pom.xml
+++ b/kernel/pom.xml
@@ -121,8 +121,8 @@
 				<version>${kernel.core.version}</version>
 			</dependency>
 			<!--
-				kernel-auth-adapter: Bearer-token validation (loaded at runtime via loader.path in Docker;
-				compile for openapi profile / optional local). License: MPL-2.0.
+				kernel-auth-adapter: Bearer-token validation (Maven dependency; bundled in service fat JAR).
+				License: MPL-2.0.
 			-->
 			<dependency>
 				<groupId>io.mosip.kernel</groupId>