diff --git a/deployments/examples/oc10_ocis_parallel/.env b/deployments/examples/oc10_ocis_parallel/.env
index e1acbbcd3..7ba204577 100644
--- a/deployments/examples/oc10_ocis_parallel/.env
+++ b/deployments/examples/oc10_ocis_parallel/.env
@@ -2,6 +2,10 @@
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 INSECURE=true
 
+# The demo users should not be created on a production instance
+# because their passwords are public
+DEMO_USERS=false
+
 ### Traefik settings ###
 TRAEFIK_LOG_LEVEL=
 # Serve Treafik dashboard. Defaults to "false".
diff --git a/deployments/examples/oc10_ocis_parallel/docker-compose.yml b/deployments/examples/oc10_ocis_parallel/docker-compose.yml
index 677877f5b..cb4a50343 100644
--- a/deployments/examples/oc10_ocis_parallel/docker-compose.yml
+++ b/deployments/examples/oc10_ocis_parallel/docker-compose.yml
@@ -124,6 +124,9 @@ services:
       OCIS_INSECURE: "${INSECURE:-false}"
       # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
       PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
+      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
     volumes:
       - ./config/ocis/proxy.yaml:/etc/ocis/proxy.yaml
       - ocis-data:/var/lib/ocis
diff --git a/deployments/examples/ocis_hello/.env b/deployments/examples/ocis_hello/.env
index cdd83740e..0e70f6b66 100644
--- a/deployments/examples/ocis_hello/.env
+++ b/deployments/examples/ocis_hello/.env
@@ -2,6 +2,10 @@
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 INSECURE=true
 
+# The demo users should not be created on a production instance
+# because their passwords are public
+DEMO_USERS=true
+
 ### Traefik settings ###
 # Serve Treafik dashboard. Defaults to "false".
 TRAEFIK_DASHBOARD=
diff --git a/deployments/examples/ocis_hello/docker-compose.yml b/deployments/examples/ocis_hello/docker-compose.yml
index 9b72e1f59..a9ff638e1 100644
--- a/deployments/examples/ocis_hello/docker-compose.yml
+++ b/deployments/examples/ocis_hello/docker-compose.yml
@@ -68,6 +68,9 @@ services:
       OCIS_INSECURE: "${INSECURE:-false}"
       # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
       PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
+      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/ocis/web-config.dist.json:/config/web-config.dist.json
diff --git a/deployments/examples/ocis_individual_services/.env b/deployments/examples/ocis_individual_services/.env
index df4a4d90a..25569f9b3 100644
--- a/deployments/examples/ocis_individual_services/.env
+++ b/deployments/examples/ocis_individual_services/.env
@@ -2,6 +2,10 @@
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 INSECURE=true
 
+# The demo users should not be created on a production instance
+# because their passwords are public
+DEMO_USERS=true
+
 ### Traefik settings ###
 # Serve Treafik dashboard. Defaults to "false".
 TRAEFIK_DASHBOARD=
diff --git a/deployments/examples/ocis_individual_services/docker-compose.yml b/deployments/examples/ocis_individual_services/docker-compose.yml
index 8c30ac2b2..bdf844a7e 100644
--- a/deployments/examples/ocis_individual_services/docker-compose.yml
+++ b/deployments/examples/ocis_individual_services/docker-compose.yml
@@ -134,6 +134,8 @@ services:
       STORAGE_LDAP_BIND_PASSWORD: ${STORAGE_LDAP_BIND_PASSWORD:-reva}
 
       ACCOUNTS_JWT_SECRET: ${OCIS_METADATA_JWT_SECRET:-Pive-Fumkiu4}
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
     volumes:
       - ./config/accounts/entrypoint-override.sh:/entrypoint-override.sh
     logging:
diff --git a/deployments/examples/ocis_keycloak/.env b/deployments/examples/ocis_keycloak/.env
index 64fb4117c..a2f80cefc 100644
--- a/deployments/examples/ocis_keycloak/.env
+++ b/deployments/examples/ocis_keycloak/.env
@@ -2,6 +2,10 @@
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 INSECURE=true
 
+# The demo users should not be created on a production instance
+# because their passwords are public
+DEMO_USERS=false
+
 ### Traefik settings ###
 # Serve Treafik dashboard. Defaults to "false".
 TRAEFIK_DASHBOARD=
diff --git a/deployments/examples/ocis_keycloak/docker-compose.yml b/deployments/examples/ocis_keycloak/docker-compose.yml
index 3047684fe..c847db801 100644
--- a/deployments/examples/ocis_keycloak/docker-compose.yml
+++ b/deployments/examples/ocis_keycloak/docker-compose.yml
@@ -63,7 +63,9 @@ services:
       OCIS_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}
       OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-error} # make oCIS less verbose
       PROXY_TLS: "false" # do not use SSL between Traefik and oCIS
-      ACCOUNTS_DEMO_USERS_AND_GROUPS: "false" # don't generate demo users
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
+      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
       # change default secrets
       IDP_LDAP_BIND_PASSWORD: ${IDP_LDAP_BIND_PASSWORD:-idp}
       STORAGE_LDAP_BIND_PASSWORD: ${STORAGE_LDAP_BIND_PASSWORD:-reva}
diff --git a/deployments/examples/ocis_ldap/.env b/deployments/examples/ocis_ldap/.env
index c998544fd..a3eebbf4c 100644
--- a/deployments/examples/ocis_ldap/.env
+++ b/deployments/examples/ocis_ldap/.env
@@ -2,6 +2,10 @@
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 INSECURE=true
 
+# The demo users should not be created on a production instance
+# because their passwords are public
+DEMO_USERS=true
+
 ### Traefik settings ###
 # Serve Treafik dashboard. Defaults to "false".
 TRAEFIK_DASHBOARD=
diff --git a/deployments/examples/ocis_ldap/docker-compose.yml b/deployments/examples/ocis_ldap/docker-compose.yml
index 60c22c280..18504d8e2 100644
--- a/deployments/examples/ocis_ldap/docker-compose.yml
+++ b/deployments/examples/ocis_ldap/docker-compose.yml
@@ -88,6 +88,9 @@ services:
       OCIS_INSECURE: "${INSECURE:-false}"
       # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
       PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
+      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/ocis/web-config.dist.json:/config/web-config.dist.json
diff --git a/deployments/examples/ocis_s3/.env b/deployments/examples/ocis_s3/.env
index b05103cfc..b53901dc4 100644
--- a/deployments/examples/ocis_s3/.env
+++ b/deployments/examples/ocis_s3/.env
@@ -2,6 +2,10 @@
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 INSECURE=true
 
+# The demo users should not be created on a production instance
+# because their passwords are public
+DEMO_USERS=true
+
 ### Traefik settings ###
 # Serve Treafik dashboard. Defaults to "false".
 TRAEFIK_DASHBOARD=
diff --git a/deployments/examples/ocis_s3/docker-compose.yml b/deployments/examples/ocis_s3/docker-compose.yml
index a3c154724..4832efcaa 100644
--- a/deployments/examples/ocis_s3/docker-compose.yml
+++ b/deployments/examples/ocis_s3/docker-compose.yml
@@ -72,6 +72,9 @@ services:
       OCIS_INSECURE: "${INSECURE:-false}"
       # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
       PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
+      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ocis-data:/var/lib/ocis
diff --git a/deployments/examples/ocis_traefik/.env b/deployments/examples/ocis_traefik/.env
index 90b69b5f2..401200836 100644
--- a/deployments/examples/ocis_traefik/.env
+++ b/deployments/examples/ocis_traefik/.env
@@ -2,6 +2,10 @@
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 INSECURE=true
 
+# The demo users should not be created on a production instance
+# because their passwords are public
+DEMO_USERS=true
+
 ### Traefik settings ###
 # Serve Treafik dashboard. Defaults to "false".
 TRAEFIK_DASHBOARD=
diff --git a/deployments/examples/ocis_traefik/docker-compose.yml b/deployments/examples/ocis_traefik/docker-compose.yml
index 1473f4820..35fc4756c 100644
--- a/deployments/examples/ocis_traefik/docker-compose.yml
+++ b/deployments/examples/ocis_traefik/docker-compose.yml
@@ -63,6 +63,9 @@ services:
       OCIS_INSECURE: "${INSECURE:-false}"
       # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
       PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
+      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ocis-data:/var/lib/ocis
diff --git a/deployments/examples/ocis_wopi/.env b/deployments/examples/ocis_wopi/.env
index b61977b07..66cfabeb7 100644
--- a/deployments/examples/ocis_wopi/.env
+++ b/deployments/examples/ocis_wopi/.env
@@ -2,6 +2,10 @@
 # It skips certificate validation for various parts of oCIS and is needed if you use self signed certificates.
 INSECURE=true
 
+# The demo users should not be created on a production instance
+# because their passwords are public
+DEMO_USERS=true
+
 ### Traefik settings ###
 # Serve Treafik dashboard. Defaults to "false".
 TRAEFIK_DASHBOARD=
diff --git a/deployments/examples/ocis_wopi/docker-compose.yml b/deployments/examples/ocis_wopi/docker-compose.yml
index d10ea2845..f1d02902f 100644
--- a/deployments/examples/ocis_wopi/docker-compose.yml
+++ b/deployments/examples/ocis_wopi/docker-compose.yml
@@ -71,6 +71,9 @@ services:
       OCIS_INSECURE: "${INSECURE:-false}"
       # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
       PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
+      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/ocis/mimetypes.json:/var/tmp/ocis/app-config/mimetypes.json