diff --git a/.ci/docker-compose-file/docker-compose-kafka.yaml b/.ci/docker-compose-file/docker-compose-kafka.yaml
index 18ef3991c..f5bdb24ec 100644
--- a/.ci/docker-compose-file/docker-compose-kafka.yaml
+++ b/.ci/docker-compose-file/docker-compose-kafka.yaml
@@ -18,7 +18,7 @@ services:
       - /tmp/emqx-ci/emqx-shared-secret:/var/lib/secret
   kdc:
     hostname: kdc.emqx.net
-    image:  ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu20.04
+    image:  ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu20.04
     container_name: kdc.emqx.net
     expose:
       - 88 # kdc
diff --git a/.ci/docker-compose-file/docker-compose.yaml b/.ci/docker-compose-file/docker-compose.yaml
index 504358419..9adbef02e 100644
--- a/.ci/docker-compose-file/docker-compose.yaml
+++ b/.ci/docker-compose-file/docker-compose.yaml
@@ -3,7 +3,7 @@ version: '3.9'
 services:
   erlang:
     container_name: erlang
-    image: ${DOCKER_CT_RUNNER_IMAGE:-ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu20.04}
+    image: ${DOCKER_CT_RUNNER_IMAGE:-ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu20.04}
     env_file:
       - conf.env
     environment:
diff --git a/.github/actions/package-macos/action.yaml b/.github/actions/package-macos/action.yaml
index 6b47ceafa..25edcb5f5 100644
--- a/.github/actions/package-macos/action.yaml
+++ b/.github/actions/package-macos/action.yaml
@@ -3,7 +3,7 @@ inputs:
   profile: # emqx, emqx-enterprise
     required: true
     type: string
-  otp: # 25.3.2-1
+  otp: # 25.3.2-2
     required: true
     type: string
   os:
diff --git a/.github/workflows/_pr_entrypoint.yaml b/.github/workflows/_pr_entrypoint.yaml
index 87c4d6145..7de9a64fd 100644
--- a/.github/workflows/_pr_entrypoint.yaml
+++ b/.github/workflows/_pr_entrypoint.yaml
@@ -17,7 +17,7 @@ env:
 jobs:
   sanity-checks:
     runs-on: ${{ github.repository_owner == 'emqx' && 'aws-amd64' || 'ubuntu-22.04' }}
-    container: "ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04"
+    container: "ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu22.04"
     outputs:
       ct-matrix: ${{ steps.matrix.outputs.ct-matrix }}
       ct-host: ${{ steps.matrix.outputs.ct-host }}
@@ -25,9 +25,9 @@ jobs:
       version-emqx: ${{ steps.matrix.outputs.version-emqx }}
       version-emqx-enterprise: ${{ steps.matrix.outputs.version-emqx-enterprise }}
       runner: ${{ github.repository_owner == 'emqx' && 'aws-amd64' || 'ubuntu-22.04' }}
-      builder: "ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04"
-      builder_vsn: "5.1-3"
-      otp_vsn: "25.3.2-1"
+      builder: "ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu22.04"
+      builder_vsn: "5.1-4"
+      otp_vsn: "25.3.2-2"
       elixir_vsn: "1.14.5"
 
     steps:
@@ -93,13 +93,13 @@ jobs:
           MATRIX="$(echo "${APPS}" | jq -c '
             [
               (.[] | select(.profile == "emqx") | . + {
-                builder: "5.1-3",
-                otp: "25.3.2-1",
+                builder: "5.1-4",
+                otp: "25.3.2-2",
                 elixir: "1.14.5"
               }),
               (.[] | select(.profile == "emqx-enterprise") | . + {
-                builder: "5.1-3",
-                otp: ["25.3.2-1"][],
+                builder: "5.1-4",
+                otp: ["25.3.2-2"][],
                 elixir: "1.14.5"
               })
             ]
diff --git a/.github/workflows/_push-entrypoint.yaml b/.github/workflows/_push-entrypoint.yaml
index bc3bc486e..afdf2a050 100644
--- a/.github/workflows/_push-entrypoint.yaml
+++ b/.github/workflows/_push-entrypoint.yaml
@@ -21,7 +21,7 @@ env:
 jobs:
   prepare:
     runs-on: ${{ github.repository_owner == 'emqx' && 'aws-amd64' || 'ubuntu-22.04' }}
-    container: 'ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04'
+    container: 'ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu22.04'
     outputs:
       profile: ${{ steps.parse-git-ref.outputs.profile }}
       release: ${{ steps.parse-git-ref.outputs.release }}
@@ -31,9 +31,9 @@ jobs:
       ct-host: ${{ steps.matrix.outputs.ct-host }}
       ct-docker: ${{ steps.matrix.outputs.ct-docker }}
       runner: ${{ github.repository_owner == 'emqx' && 'aws-amd64' || 'ubuntu-22.04' }}
-      builder: 'ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04'
-      builder_vsn: '5.1-3'
-      otp_vsn: '25.3.2-1'
+      builder: 'ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu22.04'
+      builder_vsn: '5.1-4'
+      otp_vsn: '25.3.2-2'
       elixir_vsn: '1.14.5'
 
     steps:
@@ -64,13 +64,13 @@ jobs:
           MATRIX="$(echo "${APPS}" | jq -c '
             [
               (.[] | select(.profile == "emqx") | . + {
-                builder: "5.1-3",
-                otp: "25.3.2-1",
+                builder: "5.1-4",
+                otp: "25.3.2-2",
                 elixir: "1.14.5"
               }),
               (.[] | select(.profile == "emqx-enterprise") | . + {
-                builder: "5.1-3",
-                otp: ["25.3.2-1"][],
+                builder: "5.1-4",
+                otp: ["25.3.2-2"][],
                 elixir: "1.14.5"
               })
             ]
diff --git a/.github/workflows/build_and_push_docker_images.yaml b/.github/workflows/build_and_push_docker_images.yaml
index b2bfe735b..3f568e430 100644
--- a/.github/workflows/build_and_push_docker_images.yaml
+++ b/.github/workflows/build_and_push_docker_images.yaml
@@ -61,7 +61,7 @@ on:
       otp_vsn:
         required: false
         type: string
-        default: '25.3.2-1'
+        default: '25.3.2-2'
       elixir_vsn:
         required: false
         type: string
@@ -69,7 +69,7 @@ on:
       builder_vsn:
         required: false
         type: string
-        default: '5.1-3'
+        default: '5.1-4'
       runner:
         required: false
         type: string
diff --git a/.github/workflows/build_packages.yaml b/.github/workflows/build_packages.yaml
index d33d46f11..d482d2c0e 100644
--- a/.github/workflows/build_packages.yaml
+++ b/.github/workflows/build_packages.yaml
@@ -57,7 +57,7 @@ on:
       otp_vsn:
         required: false
         type: string
-        default: '25.3.2-1'
+        default: '25.3.2-2'
       elixir_vsn:
         required: false
         type: string
@@ -69,7 +69,7 @@ on:
       builder_vsn:
         required: false
         type: string
-        default: '5.1-3'
+        default: '5.1-4'
 
 jobs:
   windows:
diff --git a/.github/workflows/build_packages_cron.yaml b/.github/workflows/build_packages_cron.yaml
index 431c4f5c4..a67ab81d2 100644
--- a/.github/workflows/build_packages_cron.yaml
+++ b/.github/workflows/build_packages_cron.yaml
@@ -24,7 +24,7 @@ jobs:
           - ['emqx-enterprise', 'release-51']
           - ['emqx-enterprise', 'release-52']
         otp:
-          - 25.3.2-1
+          - 25.3.2-2
         arch:
           - amd64
         os:
@@ -32,7 +32,7 @@ jobs:
           - ubuntu22.04
           - amzn2023
         builder:
-          - 5.1-3
+          - 5.1-4
         elixir:
           - 1.14.5
 
@@ -99,7 +99,7 @@ jobs:
         branch:
           - master
         otp:
-          - 25.3.2-1
+          - 25.3.2-2
         os:
           - macos-13
           - macos-12-arm64
diff --git a/.github/workflows/build_slim_packages.yaml b/.github/workflows/build_slim_packages.yaml
index b7ba78ef4..8e13ec0a1 100644
--- a/.github/workflows/build_slim_packages.yaml
+++ b/.github/workflows/build_slim_packages.yaml
@@ -34,15 +34,15 @@ on:
       builder:
         required: false
         type: string
-        default: 'ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04'
+        default: 'ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu22.04'
       builder_vsn:
         required: false
         type: string
-        default: '5.1-3'
+        default: '5.1-4'
       otp_vsn:
         required: false
         type: string
-        default: '25.3.2-1'
+        default: '25.3.2-2'
       elixir_vsn:
         required: false
         type: string
@@ -58,8 +58,8 @@ jobs:
       fail-fast: false
       matrix:
         profile:
-          - ["emqx", "25.3.2-1", "ubuntu20.04", "elixir"]
-          - ["emqx-enterprise", "25.3.2-1", "ubuntu20.04", "erlang"]
+          - ["emqx", "25.3.2-2", "ubuntu20.04", "elixir"]
+          - ["emqx-enterprise", "25.3.2-2", "ubuntu20.04", "erlang"]
 
     container: "ghcr.io/emqx/emqx-builder/${{ inputs.builder_vsn }}:${{ inputs.elixir_vsn }}-${{ matrix.profile[1] }}-${{ matrix.profile[2] }}"
 
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 6d4cc3dc4..a0b701d17 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -18,7 +18,7 @@ jobs:
       contents: read
       security-events: write
     container:
-      image: ghcr.io/emqx/emqx-builder/5.1-1:1.14.5-25.3.2-1-ubuntu22.04
+      image: ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu22.04
 
     strategy:
       fail-fast: false
diff --git a/.github/workflows/performance_test.yaml b/.github/workflows/performance_test.yaml
index 10b040271..224cfb0b3 100644
--- a/.github/workflows/performance_test.yaml
+++ b/.github/workflows/performance_test.yaml
@@ -23,7 +23,7 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'emqx'
-    container: ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu20.04
+    container: ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu20.04
     outputs:
       BENCH_ID: ${{ steps.prepare.outputs.BENCH_ID }}
       PACKAGE_FILE: ${{ steps.package_file.outputs.PACKAGE_FILE }}
diff --git a/.tool-versions b/.tool-versions
index 3a2251dc8..a988325fa 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,2 @@
-erlang 25.3.2-1
+erlang 25.3.2-2
 elixir 1.14.5-otp-25
diff --git a/Makefile b/Makefile
index 2f3d7067c..fc9286837 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ REBAR = $(CURDIR)/rebar3
 BUILD = $(CURDIR)/build
 SCRIPTS = $(CURDIR)/scripts
 export EMQX_RELUP ?= true
-export EMQX_DEFAULT_BUILDER = ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-debian11
+export EMQX_DEFAULT_BUILDER = ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-debian11
 export EMQX_DEFAULT_RUNNER = debian:11-slim
 export EMQX_REL_FORM ?= tgz
 export QUICER_DOWNLOAD_FROM_RELEASE = 1
diff --git a/build b/build
index 03d1ce673..874e4088c 100755
--- a/build
+++ b/build
@@ -369,9 +369,9 @@ docker_cleanup() {
 
 ## Build the default docker image based on debian 11.
 make_docker() {
-    local EMQX_BUILDER_VERSION="${EMQX_BUILDER_VERSION:-5.1-3}"
+    local EMQX_BUILDER_VERSION="${EMQX_BUILDER_VERSION:-5.1-4}"
     local EMQX_BUILDER_PLATFORM="${EMQX_BUILDER_PLATFORM:-debian11}"
-    local EMQX_BUILDER_OTP="${EMQX_BUILDER_OTP:-25.3.2-1}"
+    local EMQX_BUILDER_OTP="${EMQX_BUILDER_OTP:-25.3.2-2}"
     local EMQX_BUILDER_ELIXIR="${EMQX_BUILDER_ELIXIR:-1.14.5}"
     local EMQX_BUILDER=${EMQX_BUILDER:-ghcr.io/emqx/emqx-builder/${EMQX_BUILDER_VERSION}:${EMQX_BUILDER_ELIXIR}-${EMQX_BUILDER_OTP}-${EMQX_BUILDER_PLATFORM}}
     local EMQX_RUNNER="${EMQX_RUNNER:-${EMQX_DEFAULT_RUNNER}}"
diff --git a/changes/ce/fix-11499.en.md b/changes/ce/fix-11499.en.md
new file mode 100644
index 000000000..3ed4d1e15
--- /dev/null
+++ b/changes/ce/fix-11499.en.md
@@ -0,0 +1,3 @@
+Upgrade Erlang/OTP to 25.3.2-2
+
+Erlang/OTP 25.3.2-2 excludes sensitive data from mnesia_hook log message.
diff --git a/deploy/docker/Dockerfile b/deploy/docker/Dockerfile
index 61a143cae..76ded75eb 100644
--- a/deploy/docker/Dockerfile
+++ b/deploy/docker/Dockerfile
@@ -1,4 +1,4 @@
-ARG BUILD_FROM=ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-debian11
+ARG BUILD_FROM=ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-debian11
 ARG RUN_FROM=debian:11-slim
 FROM ${BUILD_FROM} AS builder
 
diff --git a/scripts/buildx.sh b/scripts/buildx.sh
index 462ab6612..662a7233c 100755
--- a/scripts/buildx.sh
+++ b/scripts/buildx.sh
@@ -9,7 +9,7 @@
 
 ## example:
 ## ./scripts/buildx.sh --profile emqx --pkgtype tgz --arch arm64 \
-##     --builder ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-debian11
+##     --builder ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-debian11
 
 set -euo pipefail
 
@@ -24,7 +24,7 @@ help() {
     echo "--arch amd64|arm64:        Target arch to build the EMQX package for"
     echo "--src_dir <SRC_DIR>:       EMQX source code in this dir, default to PWD"
     echo "--builder <BUILDER>:       Builder image to pull"
-    echo "                           E.g. ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-debian11"
+    echo "                           E.g. ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-debian11"
 }
 
 die() {
diff --git a/scripts/pr-sanity-checks.sh b/scripts/pr-sanity-checks.sh
index 6b193b74e..19321230b 100755
--- a/scripts/pr-sanity-checks.sh
+++ b/scripts/pr-sanity-checks.sh
@@ -12,8 +12,8 @@ if ! type "yq" > /dev/null; then
     exit 1
 fi
 
-EMQX_BUILDER_VERSION=${EMQX_BUILDER_VERSION:-5.1-3}
-EMQX_BUILDER_OTP=${EMQX_BUILDER_OTP:-25.3.2-1}
+EMQX_BUILDER_VERSION=${EMQX_BUILDER_VERSION:-5.1-4}
+EMQX_BUILDER_OTP=${EMQX_BUILDER_OTP:-25.3.2-2}
 EMQX_BUILDER_ELIXIR=${EMQX_BUILDER_ELIXIR:-1.14.5}
 EMQX_BUILDER_PLATFORM=${EMQX_BUILDER_PLATFORM:-ubuntu22.04}
 EMQX_BUILDER=${EMQX_BUILDER:-ghcr.io/emqx/emqx-builder/${EMQX_BUILDER_VERSION}:${EMQX_BUILDER_ELIXIR}-${EMQX_BUILDER_OTP}-${EMQX_BUILDER_PLATFORM}}
diff --git a/scripts/relup-test/start-relup-test-cluster.sh b/scripts/relup-test/start-relup-test-cluster.sh
index 9cc0eaffe..2cee1394e 100755
--- a/scripts/relup-test/start-relup-test-cluster.sh
+++ b/scripts/relup-test/start-relup-test-cluster.sh
@@ -22,7 +22,7 @@ WEBHOOK="webhook.$NET"
 BENCH="bench.$NET"
 COOKIE='this-is-a-secret'
 ## Erlang image is needed to run webhook server and emqtt-bench
-ERLANG_IMAGE="ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu20.04"
+ERLANG_IMAGE="ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu20.04"
 # builder has emqtt-bench installed
 BENCH_IMAGE="$ERLANG_IMAGE"