diff --git a/src/Sylius/Bundle/CoreBundle/DependencyInjection/SyliusCoreExtension.php b/src/Sylius/Bundle/CoreBundle/DependencyInjection/SyliusCoreExtension.php
index 62f47af3a3..d4ecf67109 100644
--- a/src/Sylius/Bundle/CoreBundle/DependencyInjection/SyliusCoreExtension.php
+++ b/src/Sylius/Bundle/CoreBundle/DependencyInjection/SyliusCoreExtension.php
@@ -63,6 +63,7 @@ final class SyliusCoreExtension extends AbstractResourceExtension implements Pre
         $loader->load(sprintf('services/integrations/%s.xml', $config['driver']));
 
         $this->registerResources('sylius', $config['driver'], $config['resources'], $container);
+        $this->setDefaultSecurityCsrfParameters($container);
 
         $loader->load('services.xml');
 
@@ -125,6 +126,22 @@ final class SyliusCoreExtension extends AbstractResourceExtension implements Pre
         return [];
     }
 
+    private function setDefaultSecurityCsrfParameters(ContainerBuilder $container): void
+    {
+        foreach ([
+            'sylius_admin.security.csrf_parameter' => '_csrf_admin_security_token',
+            'sylius_admin.security.csrf_token_id' => 'admin_authenticate',
+            'sylius_shop.security.csrf_parameter' => '_csrf_shop_security_token',
+            'sylius_shop.security.csrf_token_id' => 'shop_authenticate',
+        ] as $parameter => $defaultValue) {
+            if ($container->hasParameter($parameter)) {
+                continue;
+            }
+
+            $container->setParameter($parameter, $defaultValue);
+        }
+    }
+
     private function prependDefaultDriver(ContainerBuilder $container, string $driver): void
     {
         foreach ($container->getExtensions() as $name => $extension) {
diff --git a/src/Sylius/Bundle/CoreBundle/tests/DependencyInjection/SyliusCoreExtensionTest.php b/src/Sylius/Bundle/CoreBundle/tests/DependencyInjection/SyliusCoreExtensionTest.php
index 1b860f42ff..96352a567c 100644
--- a/src/Sylius/Bundle/CoreBundle/tests/DependencyInjection/SyliusCoreExtensionTest.php
+++ b/src/Sylius/Bundle/CoreBundle/tests/DependencyInjection/SyliusCoreExtensionTest.php
@@ -137,6 +137,36 @@ final class SyliusCoreExtensionTest extends AbstractExtensionTestCase
         $this->assertContainerBuilderHasParameter('sylius_core.catalog_promotions.batch_size', 100);
     }
 
+    #[Test]
+    public function it_loads_default_security_csrf_parameters_properly(): void
+    {
+        $this->container->setParameter('kernel.environment', 'dev');
+
+        $this->load();
+
+        $this->assertContainerBuilderHasParameter('sylius_admin.security.csrf_parameter', '_csrf_admin_security_token');
+        $this->assertContainerBuilderHasParameter('sylius_admin.security.csrf_token_id', 'admin_authenticate');
+        $this->assertContainerBuilderHasParameter('sylius_shop.security.csrf_parameter', '_csrf_shop_security_token');
+        $this->assertContainerBuilderHasParameter('sylius_shop.security.csrf_token_id', 'shop_authenticate');
+    }
+
+    #[Test]
+    public function it_does_not_override_configured_security_csrf_parameters(): void
+    {
+        $this->container->setParameter('kernel.environment', 'dev');
+        $this->container->setParameter('sylius_admin.security.csrf_parameter', '_custom_admin_csrf');
+        $this->container->setParameter('sylius_admin.security.csrf_token_id', 'custom_admin_authenticate');
+        $this->container->setParameter('sylius_shop.security.csrf_parameter', '_custom_shop_csrf');
+        $this->container->setParameter('sylius_shop.security.csrf_token_id', 'custom_shop_authenticate');
+
+        $this->load();
+
+        $this->assertContainerBuilderHasParameter('sylius_admin.security.csrf_parameter', '_custom_admin_csrf');
+        $this->assertContainerBuilderHasParameter('sylius_admin.security.csrf_token_id', 'custom_admin_authenticate');
+        $this->assertContainerBuilderHasParameter('sylius_shop.security.csrf_parameter', '_custom_shop_csrf');
+        $this->assertContainerBuilderHasParameter('sylius_shop.security.csrf_token_id', 'custom_shop_authenticate');
+    }
+
     #[Test]
     public function it_aliases_default_filesystem_adapter_properly(): void
     {