diff --git a/.env.example b/.env.example
index 2dbaa61..1a5ec50 100644
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,7 @@
 # IMPORTANT: must match the FunZone backend SECRET_KEY so admin JWTs validate here.
-SECRET_KEY=your-super-secret-key-change-in-production
+# Generate: python -c "import secrets; print(secrets.token_urlsafe(50))"
+# App will refuse to start if this is missing or still a placeholder.
+SECRET_KEY=
 
 DEBUG=True
 ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,testserver
diff --git a/config/settings.py b/config/settings.py
index 2111097..b3404b5 100644
--- a/config/settings.py
+++ b/config/settings.py
@@ -14,7 +14,20 @@ from decouple import config
 BASE_DIR = Path(__file__).resolve().parent.parent
 
 # Must match the FunZone backend SECRET_KEY so admin JWTs validate here.
-SECRET_KEY = config('SECRET_KEY', default='your-super-secret-key-change-in-production')
+# Refuse known insecure placeholders so the app cannot boot with a forgeable JWT key.
+_INSECURE_SECRET_KEYS = frozenset({
+    '',
+    'your-super-secret-key-change-in-production',
+    'your-super-secret-key-change-in-production-please-use-a-strong-key',
+    'your-super-secret-key-change-in-production-use-openssl-rand-base64-32',
+})
+SECRET_KEY = config('SECRET_KEY', default='')
+if SECRET_KEY.strip() in _INSECURE_SECRET_KEYS:
+    raise ValueError(
+        'SECRET_KEY is missing or insecure. Set a strong random value in .env '
+        '(must match funzone-backend). Generate with: '
+        'python -c "import secrets; print(secrets.token_urlsafe(50))"'
+    )
 
 DEBUG = config('DEBUG', default=True, cast=bool)