diff --git a/Changelog b/Changelog
index b2f2ec2..f7d92ed 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,9 @@
+2025-06-06  Christoph Pleger <pleger@irb.cs.tu-dortmund.de>
+
+	Release 4.1
+	+ Use safer function snprintf() to write into
+	  AusweisApp environment variables
+
 2025-01-13  Christoph Pleger <pleger@irb.cs.tu-dortmund.de>
 
 	Release 4.0
diff --git a/debian/changelog b/debian/changelog
index cb7cd99..f28c726 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+pam-eid (4.1-1) unstable; urgency=medium
+
+  * New upstream release
+
+ -- Christoph Pleger <pleger@irb.cs.tu-dortmund.de>  Fri, 06 Jun 2025 13:43:30 +0200
+
 pam-eid (4.0-1) unstable; urgency=medium
 
   * New upstream release
diff --git a/pam_eid.c b/pam_eid.c
index a8d67d3..7f50075 100644
--- a/pam_eid.c
+++ b/pam_eid.c
@@ -219,8 +219,8 @@ int pam_sm_authenticate(pam_handle_t *pamh,
 				exit(errno);
 			}
 
-			sprintf(envp[0], "AUSWEISAPP2_AUTOMATIC_PIN=%s", authtok);
-			sprintf(envp[1], "XDG_RUNTIME_DIR=/run/user/%d", (int) passwd->pw_uid);
+			snprintf(envp[0], sizeof("AUSWEISAPP2_AUTOMATIC_PIN=123456"), "AUSWEISAPP2_AUTOMATIC_PIN=%s", authtok);
+			snprintf(envp[1], sizeof("XDG_RUNTIME_DIR=/run/user/12345"), "XDG_RUNTIME_DIR=/run/user/%d", (int) passwd->pw_uid);
 			envp[2] = (char *) NULL;
 
 			if ((dir = opendir(strstr(envp[1], "/"))) == NULL)