diff --git a/Makefile b/Makefile
index 13319999..2f7c18fc 100644
--- a/Makefile
+++ b/Makefile
@@ -79,10 +79,16 @@ create-env-local-files:
 	@touch env.d/development/kc_postgresql.local
 .PHONY: create-env-local-files
 
+generate-secret-keys:
+generate-secret-keys: ## generate secret keys to be stored in common.local
+	@bin/generate-oidc-store-refresh-token-key.sh
+.PHONY: generate-secret-keys
+
 pre-bootstrap: \
 	data/media \
 	data/static \
-	create-env-local-files
+	create-env-local-files \
+	generate-secret-keys
 .PHONY: pre-bootstrap
 
 post-bootstrap: \
diff --git a/bin/fernetkey b/bin/fernetkey
deleted file mode 100755
index 8bbac109..00000000
--- a/bin/fernetkey
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_dc_run app-dev python -c 'from cryptography.fernet import Fernet;import sys; sys.stdout.write("\n" + Fernet.generate_key().decode() + "\n");'
diff --git a/bin/generate-oidc-store-refresh-token-key.sh b/bin/generate-oidc-store-refresh-token-key.sh
new file mode 100755
index 00000000..36fa37e7
--- /dev/null
+++ b/bin/generate-oidc-store-refresh-token-key.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+# Generate the secret OIDC_STORE_REFRESH_TOKEN_KEY and store it to common.local
+
+set -eo pipefail
+
+COMMON_LOCAL="env.d/development/common.local"
+
+OIDC_STORE_REFRESH_TOKEN_KEY=$(openssl rand -base64 32)
+
+echo "OIDC_STORE_REFRESH_TOKEN_KEY=${OIDC_STORE_REFRESH_TOKEN_KEY}" > "${COMMON_LOCAL}"
+echo "✓ OIDC_STORE_REFRESH_TOKEN_KEY generated and stored in ${COMMON_LOCAL}"
diff --git a/docs/search.md b/docs/search.md
index cb077eae..f2de68ad 100644
--- a/docs/search.md
+++ b/docs/search.md
@@ -38,4 +38,4 @@ OIDC_STORE_REFRESH_TOKEN_KEY="<your-32-byte-encryption-key==>"
 ```
 
 `OIDC_STORE_REFRESH_TOKEN_KEY` must be a valid Fernet key (32 url-safe base64-encoded bytes).
-To create one, use the `bin/fernetkey` command.
+To create one, use the `bin/generate-oidc-store-refresh-token-key.sh` command.
diff --git a/env.d/development/common b/env.d/development/common
index 601b5f40..558b3f7a 100644
--- a/env.d/development/common
+++ b/env.d/development/common
@@ -55,10 +55,6 @@ OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
 OIDC_STORE_ACCESS_TOKEN=True
 OIDC_STORE_REFRESH_TOKEN=True # Store the encrypted refresh token in the session.
 
-# Must be a valid Fernet key (32 url-safe base64-encoded bytes)
-# To create one, use the bin/fernetkey command.
-# OIDC_STORE_REFRESH_TOKEN_KEY="your-32-byte-encryption-key=="
-
 # AI
 AI_FEATURE_ENABLED=true
 AI_BASE_URL=https://openaiendpoint.com