diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1993501db29867944aca1a1afa17176bce6fd3db..fec4a4831a66f47a6a346404fbb30181ffbb9d41 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [6.1.4](https://gitlab.com/to-be-continuous/docker/compare/6.1.3...6.1.4) (2025-04-11)
+
+
+### Bug Fixes
+
+* **envsubst:** leave lines with '# nosubst' unchanged when substituting (used to be simply dropped) ([214ae5d](https://gitlab.com/to-be-continuous/docker/commit/214ae5dfc6e6661eed8eb5dd62ad4fc1bcc7d5b7))
+
 ## [6.1.3](https://gitlab.com/to-be-continuous/docker/compare/6.1.2...6.1.3) (2025-03-11)
 
 
diff --git a/README.md b/README.md
index 974ceb4d4955ba4b896cda7ce567f36ab89d472c..1ee14faefe007d28bb2a367e46465b2263f575cb 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ Add the following to your `.gitlab-ci.yml`:
 ```yaml
 include:
   # 1: include the component
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.4
     # 2: set/override component inputs
     inputs:
       build-tool: buildah # ⚠ this is only an example
@@ -30,7 +30,7 @@ Add the following to your `.gitlab-ci.yml`:
 include:
   # 1: include the template
   - project: 'to-be-continuous/docker'
-    ref: '6.1.3'
+    ref: '6.1.4'
     file: '/templates/gitlab-ci-docker.yml'
 
 variables:
@@ -565,7 +565,7 @@ Here is a `.gitlab-ci.yaml` using an external Docker registry:
 
 ```yaml
 include:
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.4
     inputs:
       snapshot-image: "registry.acme.host/$CI_PROJECT_NAME/snapshot:$CI_COMMIT_REF_SLUG"
       release-image: "registry.acme.host/$CI_PROJECT_NAME:$CI_COMMIT_REF_NAME"
@@ -580,7 +580,7 @@ Here is a `.gitlab-ci.yaml` that builds 2 Docker images from the same project (u
 
 ```yaml
 include:
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.4
 
 .docker-base:
   parallel:
@@ -635,9 +635,9 @@ With:
 ```yaml
 include:
   # main template
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.4
   # Vault variant
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker-vault@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker-vault@6.1.4
     inputs:
       # audience claim for JWT
       vault-oidc-aud: "https://vault.acme.host"
@@ -683,7 +683,7 @@ to use the snapshot image repository (will host your snapshot image as well as c
 
 ```yaml
 include:
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.4
     inputs:
       build-tool: "kaniko" # Only Kaniko has been proved to work for this use case YET
       # untested & unverified container image
@@ -691,7 +691,7 @@ include:
       # ⚠ don't forget to create the '{GCP_REGION}-docker.pkg.dev/{GCP_PROJECT_ID}/{YOUR_REPOSITORY}/{YOUR_IMAGE_NAME}/snapshot/cache' repo for Kaniko
       # validated container image (published)
       release-image: "{GCP_REGION}-docker.pkg.dev/{GCP_PROJECT_ID}/{YOUR_REPOSITORY}/{YOUR_IMAGE_NAME}:$CI_COMMIT_REF_NAME"
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker-gcp@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker-gcp@6.1.4
     inputs:
       # default WIF provider
       gcp-oidc-provider: "projects/{GCP_PROJECT_NUMBER}/locations/global/workloadIdentityPools/{YOUR_WIF_POOL_NAME}/providers/gitlab-diod"
@@ -756,14 +756,14 @@ then set the required configuration.
 
 ```yaml
 include:
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.4
     inputs:
       # untested & unverified container image
       snapshot-image: "123456789012.dkr.ecr.us-east-1.amazonaws.com/$CI_PROJECT_PATH_SLUG/snapshot:$CI_COMMIT_REF_SLUG"
       # ⚠ don't forget to create the '123456789012.dkr.ecr.us-east-1.amazonaws.com/$CI_PROJECT_PATH/snapshot/cache' repo for Kaniko
       # validated container image (published)
       release-image: "123456789012.dkr.ecr.us-east-1.amazonaws.com/$CI_PROJECT_PATH_SLUG:$CI_COMMIT_REF_NAME"
-  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker-ecr@6.1.3
+  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker-ecr@6.1.4
     inputs:
       # default Role ARN (using OIDC authentication method)
       aws-oidc-role-arn: "arn:aws:iam::123456789012:role/gitlab-ci"
diff --git a/templates/gitlab-ci-docker-ecr.yml b/templates/gitlab-ci-docker-ecr.yml
index 5c9b9de831888c8ebfde7e2f317016d4052716c5..fcb9057837e739bf591d2cf440a606aa084274f0 100644
--- a/templates/gitlab-ci-docker-ecr.yml
+++ b/templates/gitlab-ci-docker-ecr.yml
@@ -45,7 +45,7 @@ variables:
 .docker-base:
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "docker", "6.1.3"]
+      command: ["--service", "docker", "6.1.4"]
     - name: "$TBC_AWS_PROVIDER_IMAGE"
       alias: "aws-auth-provider"
   id_tokens:
diff --git a/templates/gitlab-ci-docker-gcp.yml b/templates/gitlab-ci-docker-gcp.yml
index 4d729a936da9d5a5f827974bba380508fd9bdd14..e6f7f6b54fea2cb65b67dcee0779d919724bcac0 100644
--- a/templates/gitlab-ci-docker-gcp.yml
+++ b/templates/gitlab-ci-docker-gcp.yml
@@ -44,7 +44,7 @@ variables:
 .docker-base:
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "docker", "6.1.3"]
+      command: ["--service", "docker", "6.1.4"]
     - name: "$TBC_GCP_PROVIDER_IMAGE"
       alias: "gcp-auth-provider"
   variables:
diff --git a/templates/gitlab-ci-docker-vault.yml b/templates/gitlab-ci-docker-vault.yml
index 0d5f09d69151f02c202f91fceb886df189f99939..8a762aecc371a58cb40e374d3ffc1d640c162c8e 100644
--- a/templates/gitlab-ci-docker-vault.yml
+++ b/templates/gitlab-ci-docker-vault.yml
@@ -22,7 +22,7 @@ variables:
 .docker-base:
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "docker", "6.1.3"]
+      command: ["--service", "docker", "6.1.4"]
     - name: "$TBC_VAULT_IMAGE"
       alias: "vault-secrets-provider"
   variables:
diff --git a/templates/gitlab-ci-docker.yml b/templates/gitlab-ci-docker.yml
index 6bef0c03e0610760ca4b46b9e7f45c62ed8746be..d9f9322d567adb031ed9cb11f72af1cb8a17b49d 100644
--- a/templates/gitlab-ci-docker.yml
+++ b/templates/gitlab-ci-docker.yml
@@ -763,7 +763,7 @@ stages:
 .docker-base:
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "docker", "6.1.3"]
+      command: ["--service", "docker", "6.1.4"]
   before_script:
     - !reference [.docker-scripts]
 
@@ -799,7 +799,7 @@ stages:
     _TRACE: "${TRACE}"
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "docker", "6.1.3"]
+      command: ["--service", "docker", "6.1.4"]
     - name: $DOCKER_DIND_IMAGE
       alias: docker
       command: