diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/BootstrapAdminPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/BootstrapAdminPropertyMappers.java
index 1d53767b65..a0cd635b96 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/BootstrapAdminPropertyMappers.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/BootstrapAdminPropertyMappers.java
@@ -36,11 +36,7 @@ public final class BootstrapAdminPropertyMappers {
         return new PropertyMapper[]{
                 fromOption(BootstrapAdminOptions.USERNAME)
                         .paramLabel("username")
-                        .validator((mapper, value) -> {
-                            if (!isPasswordSet()) {
-                                throw new PropertyException(mapper.getOption().getKey() + " available only when " + PASSWORD_SET);
-                            }
-                        })
+                        .validateEnabled(BootstrapAdminPropertyMappers::isPasswordSet, PASSWORD_SET)
                         .build(),
                 fromOption(BootstrapAdminOptions.PASSWORD)
                         .paramLabel("password")
@@ -52,11 +48,7 @@ public final class BootstrapAdminPropertyMappers {
                         .build(),*/
                 fromOption(BootstrapAdminOptions.CLIENT_ID)
                         .paramLabel("client id")
-                        .validator((mapper, value) -> {
-                            if (!isClientSecretSet()) {
-                                throw new PropertyException(mapper.getOption().getKey() + " available only when " + CLIENT_SECRET_SET);
-                            }
-                        })
+                        .validateEnabled(BootstrapAdminPropertyMappers::isClientSecretSet, CLIENT_SECRET_SET)
                         .build(),
                 fromOption(BootstrapAdminOptions.CLIENT_SECRET)
                         .paramLabel("client secret")
diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java
index 281e07ee8e..e714eb7c9b 100644
--- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java
+++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/PropertyMapper.java
@@ -56,6 +56,7 @@ public class PropertyMapper<T> {
             null,
             null,
             false,
+            null,
             null) {
         @Override
         public ConfigValue getConfigValue(String name, ConfigSourceInterceptorContext context) {
@@ -74,10 +75,12 @@ public class PropertyMapper<T> {
     private final String envVarFormat;
     private final String cliFormat;
     private final BiConsumer<PropertyMapper<T>, ConfigValue> validator;
+    private final String description;
 
     PropertyMapper(Option<T> option, String to, BooleanSupplier enabled, String enabledWhen,
                    BiFunction<Optional<String>, ConfigSourceInterceptorContext, Optional<String>> mapper,
-                   String mapFrom, String paramLabel, boolean mask, BiConsumer<PropertyMapper<T>, ConfigValue> validator) {
+                   String mapFrom, String paramLabel, boolean mask, BiConsumer<PropertyMapper<T>, ConfigValue> validator,
+                   String description) {
         this.option = option;
         this.to = to == null ? getFrom() : to;
         this.enabled = enabled;
@@ -89,6 +92,7 @@ public class PropertyMapper<T> {
         this.cliFormat = toCliFormat(option.getKey());
         this.envVarFormat = toEnvVarFormat(getFrom());
         this.validator = validator;
+        this.description = description;
     }
 
     private static Optional<String> defaultTransformer(Optional<String> value, ConfigSourceInterceptorContext context) {
@@ -190,7 +194,7 @@ public class PropertyMapper<T> {
     }
 
     public String getDescription() {
-        return this.option.getDescription();
+        return this.description;
     }
 
     /**
@@ -294,9 +298,11 @@ public class PropertyMapper<T> {
         private String enabledWhen = "";
         private String paramLabel;
         private BiConsumer<PropertyMapper<T>, ConfigValue> validator = (mapper, value) -> mapper.validateExpectedValues(value, mapper::validateSingleValue);
+        private String description;
 
         public Builder(Option<T> option) {
             this.option = option;
+            this.description = this.option.getDescription();
         }
 
         public Builder<T> to(String to) {
@@ -344,12 +350,29 @@ public class PropertyMapper<T> {
             this.validator = validator;
             return this;
         }
+        
+        /**
+         * Similar to {@link #enabledWhen}, but uses the condition as a validator. This allows the option
+         * to appear in help. 
+         * @param isEnabled
+         * @param enabledWhen
+         * @return
+         */
+        public Builder<T> validateEnabled(BooleanSupplier isEnabled, String enabledWhen) {
+            this.validator = (mapper, value) -> {
+                if (!isEnabled.getAsBoolean()) {
+                    throw new PropertyException(mapper.getOption().getKey() + " available only when " + enabledWhen);
+                }
+            };
+            this.description = String.format("%s Available only when %s.", this.description, enabledWhen);
+            return this;
+        }
 
         public PropertyMapper<T> build() {
             if (paramLabel == null && Boolean.class.equals(option.getType())) {
                 paramLabel = Boolean.TRUE + "|" + Boolean.FALSE;
             }
-            return new PropertyMapper<T>(option, to, isEnabled, enabledWhen, mapper, mapFrom, paramLabel, isMasked, validator);
+            return new PropertyMapper<T>(option, to, isEnabled, enabledWhen, mapper, mapFrom, paramLabel, isMasked, validator, description);
         }
     }
 
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt
index 1eeec74d49..78a3894f59 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelp.approved.txt
@@ -164,7 +164,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -174,4 +175,5 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
\ No newline at end of file
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt
index 69400c5602..0690a068b2 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt
@@ -268,7 +268,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -278,4 +279,5 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
\ No newline at end of file
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt
index dfde31e3ce..65fd8f01de 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelp.approved.txt
@@ -158,7 +158,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -168,4 +169,5 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
\ No newline at end of file
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt
index dcf0ceec09..8db463427c 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt
@@ -262,7 +262,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -272,4 +273,5 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
\ No newline at end of file
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
\ No newline at end of file
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt
index 23803c869b..60ecd8c74b 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelp.approved.txt
@@ -298,7 +298,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -308,7 +309,8 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
 
 Do NOT start the server using this command when deploying to production.
 
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt
index b7155576f7..6872628069 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt
@@ -474,7 +474,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -484,7 +485,8 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
 
 Do NOT start the server using this command when deploying to production.
 
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt
index 0e0f586124..d1c2ed5545 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelp.approved.txt
@@ -299,7 +299,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -309,7 +310,8 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
 
 By default, this command tries to update the server configuration by running a
 'build' before starting the server. You can disable this behavior by using the
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt
index 88a70ed3f3..1712340c00 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt
@@ -475,7 +475,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -485,7 +486,8 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
 
 By default, this command tries to update the server configuration by running a
 'build' before starting the server. You can disable this behavior by using the
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt
index e47ccfb585..2c62dc3399 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelp.approved.txt
@@ -241,7 +241,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -251,7 +252,8 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
 
 By default, this command tries to update the server configuration by running a
 'build' before starting the server. You can disable this behavior by using the
diff --git a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt
index c993bc32fb..cdf2e37e7d 100644
--- a/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt
+++ b/quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt
@@ -407,7 +407,8 @@ Bootstrap Admin:
 
 --bootstrap-admin-client-id <client id>
                      Client id for the temporary bootstrap admin service account. Used only when
-                       the master realm is created. Default: temp-admin.
+                       the master realm is created. Available only when bootstrap admin client
+                       secret is set. Default: temp-admin.
 --bootstrap-admin-client-secret <client secret>
                      Client secret for the temporary bootstrap admin service account. Used only
                        when the master realm is created. Use a non-CLI configuration option for
@@ -417,7 +418,8 @@ Bootstrap Admin:
                        created. Use a non-CLI configuration option for this option if possible.
 --bootstrap-admin-username <username>
                      Temporary bootstrap admin username. Used only when the master realm is
-                       created. Default: temp-admin.
+                       created. Available only when bootstrap admin password is set. Default:
+                       temp-admin.
 
 By default, this command tries to update the server configuration by running a
 'build' before starting the server. You can disable this behavior by using the