diff --git a/.env.example b/.env.example
index 7264f8f..3b81b0c 100644
--- a/.env.example
+++ b/.env.example
@@ -28,3 +28,8 @@ LITELLM_PORT=4000
 LITELLM_MASTER_KEY=
 LITELLM_SALT_KEY=
 LITELLM_DB_PASSWORD=
+# Admin UI login (https://<proxy>/ui). Without these, LiteLLM falls back to
+# username "admin" / password = LITELLM_MASTER_KEY — set these instead so the
+# master key never has to be typed into the browser.
+UI_USERNAME=admin
+UI_PASSWORD=
diff --git a/scripts/generate-secrets.sh b/scripts/generate-secrets.sh
index 1ec71b1..23024cf 100755
--- a/scripts/generate-secrets.sh
+++ b/scripts/generate-secrets.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # Generates random values for the secrets docker-compose.yml requires
-# (LITELLM_MASTER_KEY, LITELLM_SALT_KEY, LITELLM_DB_PASSWORD) and writes
-# them into .env — creating it from .env.example first if it doesn't exist.
+# (LITELLM_MASTER_KEY, LITELLM_SALT_KEY, LITELLM_DB_PASSWORD, UI_PASSWORD)
+# and writes them into .env — creating it from .env.example first if it
+# doesn't exist.
 #
 # ponytail: only fills in blank values, never overwrites ones you've already
 # set — safe to re-run. Re-running won't touch LITELLM_SALT_KEY once it's
@@ -24,5 +25,6 @@ set_if_blank() {
 set_if_blank LITELLM_MASTER_KEY "$(openssl rand -hex 32)"
 set_if_blank LITELLM_SALT_KEY "$(openssl rand -hex 32)"
 set_if_blank LITELLM_DB_PASSWORD "$(openssl rand -hex 32)"
+set_if_blank UI_PASSWORD "$(openssl rand -hex 16)"
 
 echo "Done. Review .env, then set OPENWEBUI_LITELLM_KEY per docs/proxy-key-onboarding.md."