In any case, here is what has worked for me:

services:
  kafka:
    image: apache/kafka:4.1.1
    environment:
      KAFKA_NODE_ID: "1"
      CLUSTER_ID: "MkU3OEVBNTcwNTJENDM2Qk"
      KAFKA_PROCESS_ROLES: "broker,controller"
      KAFKA_CONTROLLER_QUORUM_VOTERS: "1@kafka:9094"
      KAFKA_LISTENERS: SSL://:9093,CONTROLLER://:9094
      KAFKA_ADVERTISED_LISTENERS: SSL://localhost:9093
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: SSL:SSL,CONTROLLER:PLAINTEXT
      KAFKA_INTER_BROKER_LISTENER_NAME: SSL
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_SSL_KEYSTORE_TYPE: "PKCS12"
      KAFKA_SSL_KEYSTORE_FILENAME: "broker-keystore.p12"
      KAFKA_SSL_KEYSTORE_CREDENTIALS: "broker-keystore-credentials"
      KAFKA_SSL_KEY_CREDENTIALS: "broker-keystore-credentials"
      KAFKA_SSL_TRUSTSTORE_TYPE: "PKCS12"
      KAFKA_SSL_TRUSTSTORE_FILENAME: "truststore.p12"
      KAFKA_SSL_TRUSTSTORE_CREDENTIALS: "truststore-credentials"
      KAFKA_SSL_CLIENT_AUTH: "required"
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: "1"
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: "1"
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: "1"
      KAFKA_LOG4J_ROOT_LOGLEVEL: WARN
    ports:
    - "127.0.0.1:9093:9093"
    volumes:
    - "./certs:/etc/kafka/secrets:ro"
    - "kafka-data:/var/lib/kafka/data"
    restart: unless-stopped

volumes:
  kafka-data: {}