diff --git a/config.example.yaml b/config.example.yaml
index dff2911..e47f59f 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -29,8 +29,10 @@ database:
   path: "./data/myday.db"   # SQLite · WAL · foreign keys ON · one instance only
 
 # ── secrets — generate strong random values; never commit (D-010) ────────────
+# A placeholder is replaced with a strong value: at startup in setup mode
+# (so the wizard's ceremony is never signed with a known key) and again by the
+# wizard's `finish`. A restart adopts what `/setup` persisted.
 secrets:
-  session_key: "CHANGE_ME_32_BYTES_RANDOM"
   cookie_secret: "CHANGE_ME_32_BYTES_RANDOM"
   csrf_key: "CHANGE_ME_32_BYTES_RANDOM"
   totp_encryption_key: "CHANGE_ME_32_BYTES_RANDOM"   # A9 — TOTP secrets are encrypted at rest
diff --git a/internal/core/config/config.go b/internal/core/config/config.go
index 52b96e7..fad80c5 100644
--- a/internal/core/config/config.go
+++ b/internal/core/config/config.go
@@ -89,8 +89,9 @@ type Database struct {
 }
 
 // Secrets holds the symmetric key material (D-010). Never commit real values.
+// The wizard generates a strong value for any field left at a placeholder
+// (R-6); the startup path does the same in setup mode (M1s).
 type Secrets struct {
-	SessionKey        string `yaml:"session_key"`
 	CookieSecret      string `yaml:"cookie_secret"`
 	CSRFKey           string `yaml:"csrf_key"`
 	TOTPEncryptionKey string `yaml:"totp_encryption_key"` // A9
@@ -236,7 +237,6 @@ func (c *Config) Validate() error {
 	}
 
 	for _, s := range []struct{ name, value string }{
-		{"secrets.session_key", c.Secrets.SessionKey},
 		{"secrets.cookie_secret", c.Secrets.CookieSecret},
 		{"secrets.csrf_key", c.Secrets.CSRFKey},
 		{"secrets.totp_encryption_key", c.Secrets.TOTPEncryptionKey},
diff --git a/internal/core/config/config_test.go b/internal/core/config/config_test.go
index d7b25b9..105b534 100644
--- a/internal/core/config/config_test.go
+++ b/internal/core/config/config_test.go
@@ -34,7 +34,6 @@ app:
 database:
   path: "./data/myday.db"
 secrets:
-  session_key: "CHANGE_ME_32_BYTES_RANDOM"
   cookie_secret: "CHANGE_ME_32_BYTES_RANDOM"
   csrf_key: "CHANGE_ME_32_BYTES_RANDOM"
   totp_encryption_key: "CHANGE_ME_32_BYTES_RANDOM"
@@ -57,7 +56,6 @@ server:
 database:
   path: "./data/myday.db"
 secrets:
-  session_key: "0123456789abcdef0123456789abcdef"
   cookie_secret: "0123456789abcdef0123456789abcdef"
   csrf_key: "0123456789abcdef0123456789abcdef"
   totp_encryption_key: "0123456789abcdef0123456789abcdef"
@@ -280,7 +278,7 @@ func TestMarshalRoundTrip(t *testing.T) {
 		App:      config.App{Locale: "en-GB", Timezone: "Europe/London"},
 		Database: config.Database{Path: "./data/myday.db"},
 		Secrets: config.Secrets{
-			SessionKey: good, CookieSecret: good, CSRFKey: good, TOTPEncryptionKey: good,
+			CookieSecret: good, CSRFKey: good, TOTPEncryptionKey: good,
 		},
 		Mail:       config.Mail{Host: "smtp.example.com", Port: 587, From: "myday@example.com"},
 		Modules:    map[string]bool{"time": true},
diff --git a/internal/core/setup/setup.go b/internal/core/setup/setup.go
index ce235d0..14bb970 100644
--- a/internal/core/setup/setup.go
+++ b/internal/core/setup/setup.go
@@ -376,7 +376,6 @@ func (a *Actions) generateSecrets(c *config.Config) (bool, error) {
 		dst  *string
 		n    int
 	}{
-		{"secrets.session_key", &c.Secrets.SessionKey, 32},
 		{"secrets.cookie_secret", &c.Secrets.CookieSecret, 32},
 		{"secrets.csrf_key", &c.Secrets.CSRFKey, 32},
 	} {