diff --git a/common/network-common/src/main/java/org/apache/spark/network/ssl/SSLFactory.java b/common/network-common/src/main/java/org/apache/spark/network/ssl/SSLFactory.java
index f4b245ca7b128..2bee832e5aa70 100644
--- a/common/network-common/src/main/java/org/apache/spark/network/ssl/SSLFactory.java
+++ b/common/network-common/src/main/java/org/apache/spark/network/ssl/SSLFactory.java
@@ -338,32 +338,11 @@ private SSLEngine createEngine(boolean isClient, ByteBufAllocator allocator) {
     return engine;
   }
 
-  private static TrustManager[] credulousTrustStoreManagers() {
-    return new TrustManager[]{new X509TrustManager() {
-      @Override
-      public void checkClientTrusted(X509Certificate[] x509Certificates, String s)
-        throws CertificateException {
-      }
-
-      @Override
-      public void checkServerTrusted(X509Certificate[] x509Certificates, String s)
-        throws CertificateException {
-      }
-
-      @Override
-      public X509Certificate[] getAcceptedIssuers() {
-        return null;
-      }
-    }};
-  }
-
   private static TrustManager[] trustStoreManagers(
       File trustStore, String trustStorePassword,
       boolean trustStoreReloadingEnabled, int trustStoreReloadIntervalMs)
           throws IOException, GeneralSecurityException {
-    if (trustStore == null || !trustStore.exists()) {
-      return credulousTrustStoreManagers();
-    } else {
+    if (trustStore != null && trustStore.exists()) {
       if (trustStoreReloadingEnabled) {
         ReloadingX509TrustManager reloading = new ReloadingX509TrustManager(
           KeyStore.getDefaultType(), trustStore, trustStorePassword, trustStoreReloadIntervalMs);
@@ -372,6 +351,12 @@ private static TrustManager[] trustStoreManagers(
       } else {
         return defaultTrustManagers(trustStore, trustStorePassword);
       }
+    } else {
+      // Use the system default TrustManager instead of a "trust-all" implementation
+      TrustManagerFactory tmf = TrustManagerFactory.getInstance(
+        TrustManagerFactory.getDefaultAlgorithm());
+      tmf.init((KeyStore) null);
+      return tmf.getTrustManagers();
     }
   }
 
diff --git a/common/network-common/src/test/java/org/apache/spark/network/ssl/SSLFactorySuite.java b/common/network-common/src/test/java/org/apache/spark/network/ssl/SSLFactorySuite.java
index 922d0f22c25c6..c787d186c2c89 100644
--- a/common/network-common/src/test/java/org/apache/spark/network/ssl/SSLFactorySuite.java
+++ b/common/network-common/src/test/java/org/apache/spark/network/ssl/SSLFactorySuite.java
@@ -101,4 +101,14 @@ public void testKeyAndKeystorePasswordsAreDistinct() throws Exception {
       factory.createSSLEngine(true, ByteBufAllocator.DEFAULT);
     });
   }
+
+  @Test
+  public void testBuildWithoutTrustStoreUsesSystemDefault() throws Exception {
+    // Should not throw exception and should not use credulous managers
+    SSLFactory factory = new SSLFactory.Builder()
+      .requestedProtocol("TLSv1.3")
+      .keyStore(new File(SslSampleConfigs.keyStorePath), "password")
+      .build();
+    assertNotNull(factory.createSSLEngine(true, ByteBufAllocator.DEFAULT));
+  }
 }
diff --git a/docs/security.md b/docs/security.md
index 15b8e498617f9..eb85927012d5b 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -634,6 +634,8 @@ replaced with one of the above namespaces.
     <td>
       Path to the trust store file. The path can be absolute or relative to the directory in which
       the process is started.
+      <br />
+      If not provided, the JVM default trust store is used. <strong>Note:</strong> Starting in Spark 4.0, the insecure "trust-all" fallback behavior when a trust store is missing has been removed. Deployments relying on self-signed or internal-CA certificates must explicitly configure a trust store or add their CA to the JVM default trust store to prevent RPC connections from failing.
     </td>
     <td>ui,standalone,historyServer,rpc</td>
   </tr>