diff --git a/.env.example b/.env.example
index 8556048a..dfd3054d 100644
--- a/.env.example
+++ b/.env.example
@@ -1,6 +1,5 @@
 APP_NAME=WbStack
 APP_ENV=local
-APP_KEY=TODO
 APP_DEBUG=true
 # make sure URL (and port!) match the docker-compose setup
 APP_URL=http://localhost:8082
diff --git a/.github/workflows/composer.test.yml b/.github/workflows/composer.test.yml
index 5fa5ae36..9fafa622 100644
--- a/.github/workflows/composer.test.yml
+++ b/.github/workflows/composer.test.yml
@@ -44,7 +44,7 @@ jobs:
 
     - name: Setup - Other things
       run: |
-        docker compose exec -T api bash -c 'php artisan key:generate && php artisan passport:install --no-interaction'
+        docker compose exec -T api php artisan passport:install --no-interaction
 
     - name: PHPUnit
       run: docker compose exec -e APP_ENV=testing -T api vendor/bin/phpunit
diff --git a/Makefile b/Makefile
index ddb31b5c..4a4766ad 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ test:
 	docker compose exec api bash -c 'LOG_CHANNEL=stderr LOG_LEVEL=debug vendor/bin/phpunit ${FILTER}'
 
 init:
-	docker compose exec api bash -c 'php artisan migrate:fresh && php artisan passport:install --no-interaction && php artisan key:generate'
+	docker compose exec api bash -c 'php artisan migrate:fresh && php artisan passport:install --no-interaction'
 
 test-fresh: init test
 
diff --git a/README.md b/README.md
index 8757149a..6b23582f 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,8 @@ docker run --rm -it -v $PWD:/app -u $(id -u):$(id -g) composer:2.9.2 --ignore-pl
 
 `cp .env.example .env` and modify the contents accordingly.
 
+Docker Compose supplies a fixed development-only `APP_KEY`. Never reuse it outside local development.
+
 ### Docker compose
 
 You should be able to run some amount of this application in docker compose.
@@ -50,7 +52,7 @@ docker compose down --volumes
 Run everything in one go:
 
 ```sh
-docker compose exec api bash -c 'php artisan migrate:fresh && php artisan passport:install --no-interaction && php artisan db:seed && php artisan key:generate && php artisan storage:link'
+docker compose exec api bash -c 'php artisan migrate:fresh && php artisan passport:install --no-interaction && php artisan db:seed && php artisan storage:link'
 ```
 
 Or each command separately:
@@ -65,9 +67,6 @@ docker compose exec api php artisan passport:install --no-interaction
 # Seed some useful development data
 docker compose exec api php artisan db:seed
 
-# Generate and set the APP_KEY env variable.
-docker compose exec api php artisan key:generate
-
 # Create a symlink from `public/storage` to `storage/app/public`
 docker compose exec api php artisan storage:link
 ```
diff --git a/docker-compose.yml b/docker-compose.yml
index e14f0e18..ee91525e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -18,6 +18,8 @@ services:
       - redis
     environment:
       - CONTAINER_ROLE=app
+      # Development-only key. Never reuse outside local Docker Compose.
+      - APP_KEY=base64:7CtZbRpmIO4valwzbXDiCT0CQAo309naCXpEqkwtv5c=
   sql:
     image: "${DOCKER_DATABASE_IMAGE_NAME}"
     environment: