diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index af717ff..40e8ad7 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -46,7 +46,8 @@ if [ "$MODE" = "install" ]; then
 
     if ! command -v go &>/dev/null; then
         echo "[*] Installing Go..."
-        GO_URL="https://go.dev/dl/$(curl -sL https://go.dev/VERSION?m=text | head -1).linux-amd64.tar.gz"
+        GO_VERSION=$(curl -sL https://go.dev/VERSION?m=text)
+        GO_URL="https://go.dev/dl/${GO_VERSION}.linux-amd64.tar.gz"
         curl -sL "$GO_URL" -o /tmp/go.tar.gz
         rm -rf /usr/local/go
         tar -C /usr/local -xzf /tmp/go.tar.gz
@@ -64,7 +65,7 @@ if [ "$MODE" = "install" ]; then
     while echo "$TLS_EMAIL" | grep -qv '@'; do read -p "Invalid email: " TLS_EMAIL; done
     read -p "Admin username: " ADMIN_USERNAME
     while [ -z "$ADMIN_USERNAME" ]; do read -p "Admin username (required): " ADMIN_USERNAME; done
-    ADMIN_PASSWORD=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 12)
+    ADMIN_PASSWORD=$(openssl rand -hex 6)   # 12 chars, no pipefail issues
 
     echo ""
     echo "========================================"