diff --git a/samples/bookshop/srv/pom.xml b/samples/bookshop/srv/pom.xml
index bb3004b3e..5167d650c 100644
--- a/samples/bookshop/srv/pom.xml
+++ b/samples/bookshop/srv/pom.xml
@@ -47,7 +47,6 @@
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
-			<scope>runtime</scope>
 		</dependency>
 
 		<dependency>
diff --git a/samples/bookshop/srv/src/main/java/customer/bookshop/SecurityConfig.java b/samples/bookshop/srv/src/main/java/customer/bookshop/SecurityConfig.java
new file mode 100644
index 000000000..7d88ba303
--- /dev/null
+++ b/samples/bookshop/srv/src/main/java/customer/bookshop/SecurityConfig.java
@@ -0,0 +1,31 @@
+/*
+ * © 2024 SAP SE or an SAP affiliate company and cds-feature-attachments contributors.
+ */
+package customer.bookshop;
+
+import org.h2.server.web.JakartaWebServlet;
+import org.springframework.boot.web.servlet.ServletRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.web.firewall.HttpFirewall;
+import org.springframework.security.web.firewall.StrictHttpFirewall;
+
+@Configuration
+public class SecurityConfig {
+
+	@Bean
+	public HttpFirewall allowSemicolonHttpFirewall() {
+		StrictHttpFirewall firewall = new StrictHttpFirewall();
+		firewall.setAllowSemicolon(true);
+		return firewall;
+	}
+
+	@Bean
+	public ServletRegistrationBean<JakartaWebServlet> h2ServletRegistration() {
+		ServletRegistrationBean<JakartaWebServlet> registration =
+				new ServletRegistrationBean<>(new JakartaWebServlet(), "/h2-console/*");
+		registration.addInitParameter("-webAllowOthers", "");
+		return registration;
+	}
+
+}
diff --git a/samples/bookshop/srv/src/main/resources/application.yaml b/samples/bookshop/srv/src/main/resources/application.yaml
index f655cc3d8..919cd2f2a 100644
--- a/samples/bookshop/srv/src/main/resources/application.yaml
+++ b/samples/bookshop/srv/src/main/resources/application.yaml
@@ -7,6 +7,14 @@ spring:
   sql:
     init:
       platform: h2
+  h2:
+    console:
+      enabled: true
+      path: /h2-console
+      settings:
+        web-allow-others: true
+  security:
+    ignored: /h2-console/**
 cds:
   security:
     mock:
@@ -17,6 +25,8 @@ cds:
           - admin
         user:
           password: user
+    open-paths:
+      - /h2-console/**
   data-source:
     auto-config:
       enabled: false