diff --git a/abstractions/src/OpenSearch.OpenSearch.Ephemeral/EphemeralCluster.cs b/abstractions/src/OpenSearch.OpenSearch.Ephemeral/EphemeralCluster.cs
index bba2455f5f..f0e3769c96 100644
--- a/abstractions/src/OpenSearch.OpenSearch.Ephemeral/EphemeralCluster.cs
+++ b/abstractions/src/OpenSearch.OpenSearch.Ephemeral/EphemeralCluster.cs
@@ -34,6 +34,7 @@
 using System.Security.Cryptography;
 using System.Text;
 using OpenSearch.OpenSearch.Managed;
+using OpenSearch.OpenSearch.Managed.Configuration;
 using OpenSearch.Stack.ArtifactsApi;
 
 namespace OpenSearch.OpenSearch.Ephemeral
@@ -59,6 +60,13 @@ protected EphemeralCluster(TConfiguration clusterConfiguration) : base(clusterCo
 
 		protected EphemeralClusterComposer<TConfiguration> Composer { get; }
 
+		protected override void ModifyNodeConfiguration(NodeConfiguration nodeConfiguration, int port)
+		{
+			base.ModifyNodeConfiguration(nodeConfiguration, port);
+
+			if (!ClusterConfiguration.EnableSsl) nodeConfiguration.Add("plugins.security.disabled", "true");
+		}
+
 		public virtual ICollection<Uri> NodesUris(string hostName = null)
 		{
 			hostName = hostName ?? (ClusterConfiguration.HttpFiddlerAware && Process.GetProcessesByName("fiddler").Any()
diff --git a/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/IClusterComposeTask.cs b/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/IClusterComposeTask.cs
index cf6942a61a..d8392ad76d 100644
--- a/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/IClusterComposeTask.cs
+++ b/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/IClusterComposeTask.cs
@@ -189,12 +189,17 @@ private static void ExecuteBinaryInternal(EphemeralClusterConfiguration config,
 			var command = $"{{{binary}}} {{{string.Join(" ", arguments)}}}";
 			writer?.WriteDiagnostic($"{{{nameof(ExecuteBinary)}}} starting process [{description}] {command}");
 
-			var environment = environmentVariables != null
-				? new Dictionary<string, string>(environmentVariables)
-				: new Dictionary<string, string>();
+			var environment = new Dictionary<string, string>
+			{
+				{config.FileSystem.ConfigEnvironmentVariableName, config.FileSystem.ConfigPath},
+				{"OPENSEARCH_HOME", config.FileSystem.OpenSearchHome}
+			};
 
-			environment.Add(config.FileSystem.ConfigEnvironmentVariableName, config.FileSystem.ConfigPath);
-			environment.Add("OPENSEARCH_HOME", config.FileSystem.OpenSearchHome);
+			if (environmentVariables != null)
+			{
+				foreach (var kvp in environmentVariables)
+					environment[kvp.Key] = kvp.Value;
+			}
 
 			var timeout = TimeSpan.FromSeconds(420);
 			var processStartArguments = new StartArguments(binary, arguments)
diff --git a/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/InstallationTasks/InitialConfiguration.cs b/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/InstallationTasks/InitialConfiguration.cs
index 64d83aca57..9540c07edb 100644
--- a/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/InstallationTasks/InitialConfiguration.cs
+++ b/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/InstallationTasks/InitialConfiguration.cs
@@ -30,6 +30,7 @@
 using System.IO;
 using System.Linq;
 using OpenSearch.OpenSearch.Managed.ConsoleWriters;
+using OpenSearch.Stack.ArtifactsApi.Products;
 using SemanticVersioning;
 
 namespace OpenSearch.OpenSearch.Ephemeral.Tasks.InstallationTasks
@@ -42,56 +43,36 @@ public override void Run(IEphemeralCluster<EphemeralClusterConfiguration> cluste
 
 			var installConfigDir = Path.Combine(fs.OpenSearchHome, "config");
 			var installConfigFile = Path.Combine(installConfigDir, "opensearch.yml");
-			var configFile = Path.Combine(fs.ConfigPath, "opensearch.yml");
-			var configSecurity = Path.Combine(fs.ConfigPath, "opensearch-security");
+			var pluginSecurity = Path.Combine(fs.OpenSearchHome, "plugins/opensearch-security");
 
-			var isNewDemoScript = cluster.ClusterConfiguration.Version.BaseVersion() >= new Version(2, 12, 0);
-
-			var installSecurityConfig = Path.Combine(installConfigDir, "opensearch-security");
+			if (!Directory.Exists(pluginSecurity))
+				return;
 
-			if (isNewDemoScript && Directory.Exists(configSecurity)) Directory.Move(configSecurity, installSecurityConfig);
+			var isNewDemoScript = cluster.ClusterConfiguration.Version.BaseVersion() >= new Version(2, 12, 0);
 
-			const string securityInstallDemoConfigSubPath = "plugins/opensearch-security/tools/install_demo_configuration.sh";
-			var securityInstallDemoConfig = Path.Combine(fs.OpenSearchHome, securityInstallDemoConfigSubPath);
+			const string securityInstallDemoConfigSubPath = "tools/install_demo_configuration.sh";
+			var securityInstallDemoConfig = Path.Combine(pluginSecurity, securityInstallDemoConfigSubPath);
 
 			cluster.Writer?.WriteDiagnostic($"{{{nameof(InitialConfiguration)}}} going to run [{securityInstallDemoConfigSubPath}]");
 
-			var alreadyInstalled = File.Exists(installConfigFile) && File.ReadLines(installConfigFile).Any(l => l.Contains("plugins.security"));
-
-			if (!alreadyInstalled)
-			{
-				var env = new Dictionary<string, string>();
-				var args = new List<string> { securityInstallDemoConfig, "-y", "-i" };
-
-				if (isNewDemoScript)
-				{
-					env.Add("OPENSEARCH_INITIAL_ADMIN_PASSWORD", "admin");
-					args.Add("-t");
-				}
-
-				ExecuteBinary(
-					cluster.ClusterConfiguration,
-					cluster.Writer,
-					"/bin/bash",
-					"install security plugin demo configuration",
-					env,
-					args.ToArray());
-			}
+			if (File.Exists(installConfigFile) && File.ReadLines(installConfigFile).Any(l => l.Contains("plugins.security"))) return;
 
-			Directory.CreateDirectory(fs.ConfigPath);
+			var env = new Dictionary<string, string>();
+			var args = new List<string> { securityInstallDemoConfig, "-y", "-i" };
 
 			if (isNewDemoScript)
 			{
-				Directory.CreateDirectory(configSecurity);
-				CopyFolder(installSecurityConfig, configSecurity);
+				env.Add("OPENSEARCH_INITIAL_ADMIN_PASSWORD", "admin");
+				args.Add("-t");
 			}
 
-			foreach (var f in new[]{"opensearch.yml", "esnode.pem", "esnode-key.pem", "root-ca.pem"})
-				File.Copy(Path.Combine(installConfigDir, f), Path.Combine(fs.ConfigPath, f), true);
-
-			if (cluster.ClusterConfiguration.EnableSsl) return;
-
-			File.AppendAllText(configFile, "plugins.security.disabled: true");
+			ExecuteBinary(
+				cluster.ClusterConfiguration,
+				cluster.Writer,
+				"/bin/bash",
+				"install security plugin demo configuration",
+				env,
+				args.ToArray());
 		}
 	}
 }
diff --git a/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/InstallationTasks/InstallPlugins.cs b/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/InstallationTasks/InstallPlugins.cs
index c64501038e..afcb93db1c 100644
--- a/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/InstallationTasks/InstallPlugins.cs
+++ b/abstractions/src/OpenSearch.OpenSearch.Ephemeral/Tasks/InstallationTasks/InstallPlugins.cs
@@ -27,6 +27,7 @@
 */
 
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Net.Http;
@@ -93,12 +94,21 @@ public override void Run(IEphemeralCluster<EphemeralClusterConfiguration> cluste
 				cluster.Writer?.WriteDiagnostic(
 					$"{{{nameof(InstallPlugins)}}} attempting install [{plugin.SubProductName}] as it's not OOTB: {{{plugin.ShippedByDefaultAsOf}}} and valid for {v}: {{{plugin.IsValid(v)}}}");
 
-				if (!Directory.Exists(fs.ConfigPath)) Directory.CreateDirectory(fs.ConfigPath);
+				var homeConfigPath = Path.Combine(fs.OpenSearchHome, "config");
+
+				if (!Directory.Exists(homeConfigPath)) Directory.CreateDirectory(homeConfigPath);
+
+				var env = new Dictionary<string, string>
+				{
+					{ fs.ConfigEnvironmentVariableName, homeConfigPath }
+				};
+
 				ExecuteBinary(
 					cluster.ClusterConfiguration,
 					cluster.Writer,
 					fs.PluginBinary,
 					$"install opensearch plugin: {plugin.SubProductName}",
+					env,
 					"install --batch", GetPluginLocation(plugin, v));
 
 				CopyConfigDirectoryToHomeCacheConfigDirectory(cluster, plugin);