diff --git a/database/seeders/DemoCustomerSeeder.php b/database/seeders/DemoCustomerSeeder.php
index 83f045a..c5fe913 100644
--- a/database/seeders/DemoCustomerSeeder.php
+++ b/database/seeders/DemoCustomerSeeder.php
@@ -16,6 +16,7 @@ use App\Models\User;
 use Illuminate\Database\Seeder;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
 
 /**
  * One complete customer, written as real rows.
@@ -39,11 +40,22 @@ class DemoCustomerSeeder extends Seeder
 
     public function run(): void
     {
+        // The demo account is a real login on a panel that is reachable from the
+        // public internet, so it never gets a password written in a source file.
+        // DEMO_PASSWORD if the operator set one, otherwise a fresh random one
+        // printed once — a weak default would sit on production forever, and
+        // "it is only the demo" is how the first account gets taken.
+        $password = (string) (env('DEMO_PASSWORD') ?: Str::password(24));
+
         $user = User::firstOrCreate(
             ['email' => self::EMAIL],
-            ['name' => 'Kanzlei Muster', 'password' => Hash::make(config('app.demo_password', 'Muster!2026'))],
+            ['name' => 'Kanzlei Muster', 'password' => Hash::make($password)],
         );
 
+        if ($user->wasRecentlyCreated) {
+            $this->command?->warn('Demo password (shown once): '.$password);
+        }
+
         $customer = Customer::firstOrCreate(
             ['user_id' => $user->id],
             ['name' => 'Kanzlei Muster', 'email' => self::EMAIL, 'contact_name' => 'Dr. M. Muster', 'status' => 'active'],