diff --git a/labhelper/settings.py b/labhelper/settings.py
index d2d7562..b3e8306 100644
--- a/labhelper/settings.py
+++ b/labhelper/settings.py
@@ -14,6 +14,8 @@ import os
 import re
 from pathlib import Path
 
+from django.core.management.utils import get_random_secret_key
+
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
@@ -22,10 +24,10 @@ BASE_DIR = Path(__file__).resolve().parent.parent
 # See https://docs.djangoproject.com/en/5.2/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = os.environ.get(
-    "DJANGO_SECRET_KEY",
-    "f0arjg8q3ut4iuqrguqfjaruf0eripIZZN3t1kymy8ugqnj$li2knhha0@gc5v8f3bge=$+gbybj2$jt28uqm",
-)
+# Production supplies DJANGO_SECRET_KEY via the Kubernetes secret. If it is unset
+# (local dev), fall back to an ephemeral random key rather than a committed literal;
+# sessions won't survive a restart, which is fine for development.
+SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY") or get_random_secret_key()
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = os.environ.get("DEBUG", "True").lower() == "true"