diff --git a/avm/res/container-instance/container-group/README.md b/avm/res/container-instance/container-group/README.md
index c93906a3f9..983ca8cf49 100644
--- a/avm/res/container-instance/container-group/README.md
+++ b/avm/res/container-instance/container-group/README.md
@@ -355,7 +355,16 @@ module containerGroup 'br/public:avm/res/container-instance/container-group:<ver
         name: 'az-aci-x-001'
         properties: {
           command: []
-          environmentVariables: []
+          environmentVariables: [
+            {
+              name: 'CLIENT_ID'
+              value: 'TestClientId'
+            }
+            {
+              name: 'CLIENT_SECRET'
+              secureValue: 'TestSecret'
+            }
+          ]
           image: 'mcr.microsoft.com/azuredocs/aci-helloworld'
           ports: [
             {
@@ -447,7 +456,16 @@ module containerGroup 'br/public:avm/res/container-instance/container-group:<ver
           "name": "az-aci-x-001",
           "properties": {
             "command": [],
-            "environmentVariables": [],
+            "environmentVariables": [
+              {
+                "name": "CLIENT_ID",
+                "value": "TestClientId"
+              },
+              {
+                "name": "CLIENT_SECRET",
+                "secureValue": "TestSecret"
+              }
+            ],
             "image": "mcr.microsoft.com/azuredocs/aci-helloworld",
             "ports": [
               {
@@ -1268,7 +1286,7 @@ The environment variables to set in the container instance.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`secureValue`](#parameter-containerspropertiesenvironmentvariablessecurevalue) | string | The value of the secure environment variable. |
+| [`secureValue`](#parameter-containerspropertiesenvironmentvariablessecurevalue) | securestring | The value of the secure environment variable. |
 | [`value`](#parameter-containerspropertiesenvironmentvariablesvalue) | string | The value of the environment variable. |
 
 ### Parameter: `containers.properties.environmentVariables.name`
@@ -1283,7 +1301,7 @@ The name of the environment variable.
 The value of the secure environment variable.
 
 - Required: No
-- Type: string
+- Type: securestring
 
 ### Parameter: `containers.properties.environmentVariables.value`
 
@@ -1506,6 +1524,56 @@ The image registry credentials by which the container group is created from.
 - Required: No
 - Type: array
 
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`server`](#parameter-imageregistrycredentialsserver) | string | The Docker image registry server without a protocol such as "http" and "https". |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`identity`](#parameter-imageregistrycredentialsidentity) | string | The identity for the private registry. |
+| [`identityUrl`](#parameter-imageregistrycredentialsidentityurl) | string | The identity URL for the private registry. |
+| [`password`](#parameter-imageregistrycredentialspassword) | securestring | The password for the private registry. |
+| [`username`](#parameter-imageregistrycredentialsusername) | string | The username for the private registry. |
+
+### Parameter: `imageRegistryCredentials.server`
+
+The Docker image registry server without a protocol such as "http" and "https".
+
+- Required: Yes
+- Type: string
+
+### Parameter: `imageRegistryCredentials.identity`
+
+The identity for the private registry.
+
+- Required: No
+- Type: string
+
+### Parameter: `imageRegistryCredentials.identityUrl`
+
+The identity URL for the private registry.
+
+- Required: No
+- Type: string
+
+### Parameter: `imageRegistryCredentials.password`
+
+The password for the private registry.
+
+- Required: No
+- Type: securestring
+
+### Parameter: `imageRegistryCredentials.username`
+
+The username for the private registry.
+
+- Required: No
+- Type: string
+
 ### Parameter: `initContainers`
 
 A list of container definitions which will be executed before the application container starts.
diff --git a/avm/res/container-instance/container-group/main.bicep b/avm/res/container-instance/container-group/main.bicep
index 93289ff0e2..7000d64c84 100644
--- a/avm/res/container-instance/container-group/main.bicep
+++ b/avm/res/container-instance/container-group/main.bicep
@@ -30,7 +30,7 @@ param restartPolicy string = 'Always'
 param ipAddressType string = 'Public'
 
 @description('Optional. The image registry credentials by which the container group is created from.')
-param imageRegistryCredentials array?
+param imageRegistryCredentials imageRegistryCredentialType
 
 @description('Optional. Location for all Resources.')
 param location string = resourceGroup().location
@@ -100,47 +100,43 @@ var identity = !empty(managedIdentities)
     }
   : null
 
-resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' =
-  if (enableTelemetry) {
-    name: '46d3xbcp.res.containerinstance-containergroup.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
-    properties: {
-      mode: 'Incremental'
-      template: {
-        '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
-        contentVersion: '1.0.0.0'
-        resources: []
-        outputs: {
-          telemetry: {
-            type: 'String'
-            value: 'For more information, see https://aka.ms/avm/TelemetryInfo'
-          }
+resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' = if (enableTelemetry) {
+  name: '46d3xbcp.res.containerinstance-containergroup.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
+  properties: {
+    mode: 'Incremental'
+    template: {
+      '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
+      contentVersion: '1.0.0.0'
+      resources: []
+      outputs: {
+        telemetry: {
+          type: 'String'
+          value: 'For more information, see https://aka.ms/avm/TelemetryInfo'
         }
       }
     }
   }
+}
 
-resource cMKKeyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing =
-  if (!empty(customerManagedKey.?keyVaultResourceId)) {
-    name: last(split((customerManagedKey.?keyVaultResourceId ?? 'dummyVault'), '/'))
-    scope: resourceGroup(
-      split((customerManagedKey.?keyVaultResourceId ?? '//'), '/')[2],
-      split((customerManagedKey.?keyVaultResourceId ?? '////'), '/')[4]
-    )
-
-    resource cMKKey 'keys@2023-02-01' existing =
-      if (!empty(customerManagedKey.?keyVaultResourceId) && !empty(customerManagedKey.?keyName)) {
-        name: customerManagedKey.?keyName ?? 'dummyKey'
-      }
-  }
+resource cMKKeyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId)) {
+  name: last(split((customerManagedKey.?keyVaultResourceId ?? 'dummyVault'), '/'))
+  scope: resourceGroup(
+    split((customerManagedKey.?keyVaultResourceId ?? '//'), '/')[2],
+    split((customerManagedKey.?keyVaultResourceId ?? '////'), '/')[4]
+  )
 
-resource cMKUserAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing =
-  if (!empty(customerManagedKey.?userAssignedIdentityResourceId)) {
-    name: last(split(customerManagedKey.?userAssignedIdentityResourceId ?? 'dummyMsi', '/'))
-    scope: resourceGroup(
-      split((customerManagedKey.?userAssignedIdentityResourceId ?? '//'), '/')[2],
-      split((customerManagedKey.?userAssignedIdentityResourceId ?? '////'), '/')[4]
-    )
+  resource cMKKey 'keys@2023-02-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId) && !empty(customerManagedKey.?keyName)) {
+    name: customerManagedKey.?keyName ?? 'dummyKey'
   }
+}
+
+resource cMKUserAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = if (!empty(customerManagedKey.?userAssignedIdentityResourceId)) {
+  name: last(split(customerManagedKey.?userAssignedIdentityResourceId ?? 'dummyMsi', '/'))
+  scope: resourceGroup(
+    split((customerManagedKey.?userAssignedIdentityResourceId ?? '//'), '/')[2],
+    split((customerManagedKey.?userAssignedIdentityResourceId ?? '////'), '/')[4]
+  )
+}
 
 resource containergroup 'Microsoft.ContainerInstance/containerGroups@2023-05-01' = {
   name: name
@@ -193,17 +189,16 @@ resource containergroup 'Microsoft.ContainerInstance/containerGroups@2023-05-01'
   )
 }
 
-resource containergroup_lock 'Microsoft.Authorization/locks@2020-05-01' =
-  if (!empty(lock ?? {}) && lock.?kind != 'None') {
-    name: lock.?name ?? 'lock-${name}'
-    properties: {
-      level: lock.?kind ?? ''
-      notes: lock.?kind == 'CanNotDelete'
-        ? 'Cannot delete resource or child resources.'
-        : 'Cannot delete or modify the resource or child resources.'
-    }
-    scope: containergroup
+resource containergroup_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') {
+  name: lock.?name ?? 'lock-${name}'
+  properties: {
+    level: lock.?kind ?? ''
+    notes: lock.?kind == 'CanNotDelete'
+      ? 'Cannot delete resource or child resources.'
+      : 'Cannot delete or modify the resource or child resources.'
   }
+  scope: containergroup
+}
 
 @description('The name of the container group.')
 output name string = containergroup.name
@@ -353,6 +348,7 @@ type containerType = {
       name: string
 
       @description('Optional. The value of the secure environment variable.')
+      @secure()
       secureValue: string?
 
       @description('Optional. The value of the environment variable.')
@@ -361,6 +357,24 @@ type containerType = {
   }
 }[]
 
+type imageRegistryCredentialType = {
+  @description('Required. The Docker image registry server without a protocol such as "http" and "https".')
+  server: string
+
+  @description('Optional. The identity for the private registry.')
+  identity: string?
+
+  @description('Optional. The identity URL for the private registry.')
+  identityUrl: string?
+
+  @description('Optional. The username for the private registry.')
+  username: string?
+
+  @description('Optional. The password for the private registry.')
+  @secure()
+  password: string?
+}[]?
+
 type ipAddressPortsType = {
   @description('Required. The port number exposed on the container instance.')
   port: int
diff --git a/avm/res/container-instance/container-group/main.json b/avm/res/container-instance/container-group/main.json
index c96c58751f..d57e095ce5 100644
--- a/avm/res/container-instance/container-group/main.json
+++ b/avm/res/container-instance/container-group/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.26.54.24096",
-      "templateHash": "1114274520149552239"
+      "version": "0.27.1.19265",
+      "templateHash": "5407376593955341482"
     },
     "name": "Container Instances Container Groups",
     "description": "This module deploys a Container Instance Container Group.",
@@ -115,6 +115,7 @@
               },
               "livenessProbe": {
                 "type": "object",
+                "properties": {},
                 "nullable": true,
                 "metadata": {
                   "description": "Optional. The liveness probe."
@@ -335,7 +336,7 @@
                       }
                     },
                     "secureValue": {
-                      "type": "string",
+                      "type": "securestring",
                       "nullable": true,
                       "metadata": {
                         "description": "Optional. The value of the secure environment variable."
@@ -363,6 +364,49 @@
         }
       }
     },
+    "imageRegistryCredentialType": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "server": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The Docker image registry server without a protocol such as \"http\" and \"https\"."
+            }
+          },
+          "identity": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The identity for the private registry."
+            }
+          },
+          "identityUrl": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The identity URL for the private registry."
+            }
+          },
+          "username": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The username for the private registry."
+            }
+          },
+          "password": {
+            "type": "securestring",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The password for the private registry."
+            }
+          }
+        }
+      },
+      "nullable": true
+    },
     "ipAddressPortsType": {
       "type": "array",
       "items": {
@@ -457,8 +501,7 @@
       }
     },
     "imageRegistryCredentials": {
-      "type": "array",
-      "nullable": true,
+      "$ref": "#/definitions/imageRegistryCredentialType",
       "metadata": {
         "description": "Optional. The image registry credentials by which the container group is created from."
       }
diff --git a/avm/res/container-instance/container-group/tests/e2e/max/main.test.bicep b/avm/res/container-instance/container-group/tests/e2e/max/main.test.bicep
index a42aa7e86c..792cfbb7a3 100644
--- a/avm/res/container-instance/container-group/tests/e2e/max/main.test.bicep
+++ b/avm/res/container-instance/container-group/tests/e2e/max/main.test.bicep
@@ -61,7 +61,16 @@ module testDeployment '../../../main.bicep' = [
           name: '${namePrefix}-az-aci-x-001'
           properties: {
             command: []
-            environmentVariables: []
+            environmentVariables: [
+              {
+                name: 'CLIENT_ID'
+                value: 'TestClientId'
+              }
+              {
+                name: 'CLIENT_SECRET'
+                secureValue: 'TestSecret'
+              }
+            ]
             image: 'mcr.microsoft.com/azuredocs/aci-helloworld'
             ports: [
               {