diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index 0824f38..33a2913 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -97,7 +97,9 @@ if [ "$MODE" = "install" ]; then
     while echo "$TLS_EMAIL" | grep -qv '@'; do read -p "Invalid email: " TLS_EMAIL; done
     read -p "Admin username: " ADMIN_USERNAME
     while [ -z "$ADMIN_USERNAME" ]; do read -p "Admin username (required): " ADMIN_USERNAME; done
-    ADMIN_PASSWORD=$(openssl rand -hex 12)   # 24 chars, hex only (no special chars)
+    # 24 chars, mixed case + numbers, no special chars (safe for .env)
+    ADMIN_PASSWORD=$(openssl rand -base64 30 | tr -dc 'A-Za-z0-9')
+    ADMIN_PASSWORD="${ADMIN_PASSWORD:0:24}"
 
     echo ""
     echo "========================================"