diff --git a/Makefile b/Makefile
index 13319999b..2f7c18fc6 100644
--- a/Makefile
+++ b/Makefile
@@ -79,10 +79,16 @@ create-env-local-files:
 	@touch env.d/development/kc_postgresql.local
 .PHONY: create-env-local-files
 
+generate-secret-keys:
+generate-secret-keys: ## generate secret keys to be stored in common.local
+	@bin/generate-oidc-store-refresh-token-key.sh
+.PHONY: generate-secret-keys
+
 pre-bootstrap: \
 	data/media \
 	data/static \
-	create-env-local-files
+	create-env-local-files \
+	generate-secret-keys
 .PHONY: pre-bootstrap
 
 post-bootstrap: \
diff --git a/bin/fernetkey b/bin/fernetkey
deleted file mode 100755
index 8bbac1096..000000000
--- a/bin/fernetkey
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_dc_run app-dev python -c 'from cryptography.fernet import Fernet;import sys; sys.stdout.write("\n" + Fernet.generate_key().decode() + "\n");'
diff --git a/bin/generate-oidc-store-refresh-token-key.sh b/bin/generate-oidc-store-refresh-token-key.sh
new file mode 100755
index 000000000..87746d84e
--- /dev/null
+++ b/bin/generate-oidc-store-refresh-token-key.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# Generate the secret OIDC_STORE_REFRESH_TOKEN_KEY and store it to common.local
+
+set -eo pipefail
+
+COMMON_LOCAL="env.d/development/common.local"
+
+OIDC_STORE_REFRESH_TOKEN_KEY=$(openssl rand -base64 32)
+
+echo "" >> "${COMMON_LOCAL}"
+echo "OIDC_STORE_REFRESH_TOKEN_KEY=${OIDC_STORE_REFRESH_TOKEN_KEY}" >> "${COMMON_LOCAL}"
+echo "✓ OIDC_STORE_REFRESH_TOKEN_KEY generated and stored in ${COMMON_LOCAL}"
diff --git a/docs/search.md b/docs/search.md
index cb077eae0..f2de68ad9 100644
--- a/docs/search.md
+++ b/docs/search.md
@@ -38,4 +38,4 @@ OIDC_STORE_REFRESH_TOKEN_KEY="<your-32-byte-encryption-key==>"
 ```
 
 `OIDC_STORE_REFRESH_TOKEN_KEY` must be a valid Fernet key (32 url-safe base64-encoded bytes).
-To create one, use the `bin/fernetkey` command.
+To create one, use the `bin/generate-oidc-store-refresh-token-key.sh` command.