diff --git a/src/plone/restapi/setuphandlers.py b/src/plone/restapi/setuphandlers.py
index a1a3948172..7b01de357f 100644
--- a/src/plone/restapi/setuphandlers.py
+++ b/src/plone/restapi/setuphandlers.py
@@ -46,6 +46,8 @@ def install_pas_plugin(context):
                     "ICredentialsResetPlugin",
                 ],
             )
+            if not is_plone_site:
+                plugin.use_keyring = False
 
 
 def post_install_default(context):
diff --git a/src/plone/restapi/upgrades/to0007.py b/src/plone/restapi/upgrades/to0007.py
index c315766a5f..0c3af18424 100644
--- a/src/plone/restapi/upgrades/to0007.py
+++ b/src/plone/restapi/upgrades/to0007.py
@@ -22,6 +22,12 @@ def enable_new_pas_plugin_interfaces(context):
     portal = getToolByName(context, "portal_url").getPortalObject()
     for uf, is_plone_site in pas.iter_ancestor_pas(portal):
         for jwt_plugin in uf.objectValues(plugin.JWTAuthenticationPlugin.meta_type):
+            if not is_plone_site and jwt_plugin.use_keyring:
+                logger.info(
+                    "Disabling keyring for plugin outside of Plone: %s",
+                    "/".join(jwt_plugin.getPhysicalPath()),
+                )
+                jwt_plugin.use_keyring = False
             for new_iface in (
                 plugins_ifaces.ICredentialsUpdatePlugin,
                 plugins_ifaces.ICredentialsResetPlugin,