diff --git a/.env.test b/.env.test
index 8b8ebb6..db311f6 100644
--- a/.env.test
+++ b/.env.test
@@ -3,3 +3,7 @@ TRAP_CCLIBS_TEST_TIMEOUT_SECONDS=3
 
 # Dedicated `just test-timeout` fixture timings.
 TRAP_CCLIBS_TEST_TIMEOUT_WATCHDOG_SECONDS=1
+
+# Test placeholder. The real value is generated in `.env` on first `just install`,
+# or after `just clean` / `just reinstall`.
+TRAP_CCLIBS_OPENCODE_PASSWORD=redacted
diff --git a/Justfile b/Justfile
index 2d12c0e..61c36cc 100644
--- a/Justfile
+++ b/Justfile
@@ -6,7 +6,14 @@ default:
     @just --list
 
 # Install local development tooling.
-install: install-git-hooks check-install
+install: install-git-hooks check-install generate-env
+
+# Remove generated local environment files.
+clean:
+    rm -f .env
+
+# Recreate local generated files and development tooling.
+reinstall: clean install
 
 # Install Git hooks for this repository.
 install-git-hooks:
@@ -68,8 +75,35 @@ check-luacheck:
         exit 1; \
     }
 
+# Verify openssl is installed.
+check-openssl:
+    @command -v openssl >/dev/null 2>&1 || { \
+        printf '%s\n' 'openssl not found on $PATH. See DEVELOPMENT.md.' >&2; \
+        exit 1; \
+    }
+
 # Verify tools needed for local installation and CraftOS-PC launch recipes.
-check-install: check-craftos check-jq check-luacheck
+check-install: check-craftos check-jq check-luacheck check-openssl
+
+# Generate local secrets on first install.
+generate-env:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ -f .env ]; then
+        exit 0
+    fi
+    password="$(openssl rand -hex 32)"
+    while IFS= read -r line || [ -n "$line" ]; do
+        case "$line" in
+            TRAP_CCLIBS_OPENCODE_PASSWORD=*)
+                printf '%s\n' "TRAP_CCLIBS_OPENCODE_PASSWORD=$password"
+                ;;
+            *)
+                printf '%s\n' "$line"
+                ;;
+        esac
+    done < .env.test > .env
+    printf '%s\n' 'Generated .env'
 
 # Pass args through to `craftos`, for example:
 #   just craftos --headless --exec 'print("__TRAPOS_TEST_OK__"); os.shutdown()'