diff --git a/CHANGELOG.md b/CHANGELOG.md
index 277605ce5..e3691a069 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
-## Added
+### Added
 - model for D-Link cisco like CLI (@mirackle-spb)
 - model for Ruijie Networks RGOS devices (@spike77453)
 - Add serial number collection to Opengear (@ermuller)
@@ -21,7 +21,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - model for Fibrestore (fs.com) FSOS (@tcrichton)
 - model for IP Infusion OcNOS
 
-## Changed
+### Changed
 - tp-link: fixed enable mode post login entrance (@mirackle-spb)
 - dlink: fixed prompt for other dlink switches, added additional uptime removal expressions (@mirackle-spb)
 - Collect VC info for juniper ex3400 (@ermuller)
@@ -37,9 +37,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - ciscosmb: ignore "Please change the password" hint when doing backup. (@sharteeya)
 - dlinknextgen removes user and snmp-server secrets (@tcrichton)
 - dnos: hide secrets in "ospf message-digest-key", "authentication-type" and "bsd-username" (@rybnico)
+- junos: Replace dynamic value in VMX-BANDWIDTH with count, hide ssh keys
 
-
-## Fixed
+### Fixed
 - fixed empty lines for ZyXEL GS1900 switches (@jluebbe)
 - fixed prompt for Watchguard FirewareOS not matching the regex when the node is non-master (@netdiver)
 - defined 'psych' runtime dependency to resolve 'unsafe_load' error during startup (@MattKobayashi)
@@ -64,13 +64,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [0.29.1 - 2023-04-24]
 
-## Added
+### Added
 
-## Changed
+### Changed
 
 - Ensure Docker builds are only pushed to registry on `master` (@aschaber1)
 
-## Fixed
+### Fixed
 
 - #2749: fix issues with `cut_both`
 
diff --git a/lib/oxidized/model/junos.rb b/lib/oxidized/model/junos.rb
index 39f06db75..1ed0cc568 100644
--- a/lib/oxidized/model/junos.rb
+++ b/lib/oxidized/model/junos.rb
@@ -1,6 +1,5 @@
 class JunOS < Oxidized::Model
   using Refinements
-
   comment '# '
 
   def telnet
@@ -10,11 +9,13 @@ def telnet
   cmd :all do |cfg|
     cfg = cfg.cut_both if screenscrape
     cfg.gsub!(/  scale-subscriber (\s+)(\d+)/, '  scale-subscriber                <count>')
+    cfg.gsub!(/VMX-BANDWIDTH\s+(\d+) (.*)/, 'VMX-BANDWIDTH                  <count> \2')
     cfg.lines.map { |line| line.rstrip }.join("\n") + "\n"
   end
 
   cmd :secret do |cfg|
     cfg.gsub!(/community (\S+) {/, 'community <hidden> {')
+    cfg.gsub!(/(ssh-(rsa|dsa|ecdsa|ecdsa-sk|ed25519|ed25519-sk) )".*; ## SECRET-DATA/, '<secret removed>')
     cfg.gsub!(/ "\$\d\$\S+; ## SECRET-DATA/, ' <secret removed>;')
     cfg
   end
diff --git a/oxidized.gemspec b/oxidized.gemspec
index 3d8e0e586..fb53e2a58 100644
--- a/oxidized.gemspec
+++ b/oxidized.gemspec
@@ -38,7 +38,7 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'mocha',               '~> 2.1'
   s.add_development_dependency 'pry',                 '~> 0.14.2'
   s.add_development_dependency 'rake',                '~> 13.0'
-  s.add_development_dependency 'rubocop',             '~> 1.60.0'
+  s.add_development_dependency 'rubocop',             '~> 1.61.0'
   s.add_development_dependency 'rubocop-minitest',    '~> 0.34.4'
   s.add_development_dependency 'rubocop-rake',        '~> 0.6.0'
   s.add_development_dependency 'simplecov',           '~> 0.22.0'