diff --git a/_modules/scripts/migrate_options.sh b/_modules/scripts/migrate_options.sh
index 6a584b9f7..5d6ff32bc 100644
--- a/_modules/scripts/migrate_options.sh
+++ b/_modules/scripts/migrate_options.sh
@@ -14,6 +14,7 @@ migrate_config_options() {
     FLATCURVE_EXPERIMENTAL
     DISABLE_IPv6
     ACME_CONTACT
+    SOGO_URL_ENCRYPTION_KEY
   )
 
   for key in "${KEYS[@]}"; do
@@ -62,6 +63,12 @@ migrate_config_options() {
           sed -i '/^ACME_CONTACT=.*/d' mailcow.conf
           sed -i '/^#ACME_CONTACT=.*/d' mailcow.conf
           ;;
+        SOGO_URL_ENCRYPTION_KEY)
+          echo "Removing ${key} in mailcow.conf (moved to sogo.conf)"
+          sed -i '/^# SOGo URL encryption key/d' mailcow.conf
+          sed -i '/^# This key is used to encrypt email addresses within SOGo URLs/d' mailcow.conf
+          sed -i '/^SOGO_URL_ENCRYPTION_KEY=.*/d' mailcow.conf
+          ;;
       esac
     fi
   done
diff --git a/_modules/scripts/new_options.sh b/_modules/scripts/new_options.sh
index 30c747b70..58c4d69f9 100644
--- a/_modules/scripts/new_options.sh
+++ b/_modules/scripts/new_options.sh
@@ -43,7 +43,6 @@ adapt_new_options() {
   "ALLOW_ADMIN_EMAIL_LOGIN"
   "SKIP_HTTP_VERIFICATION"
   "SOGO_EXPIRE_SESSION"
-  "SOGO_URL_ENCRYPTION_KEY"
   "REDIS_PORT"
   "REDISPASS"
   "DOVECOT_MASTER_USER"
@@ -287,11 +286,6 @@ adapt_new_options() {
         REDISPASS)
             echo "REDISPASS=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2>/dev/null | head -c 28)" >> mailcow.conf
             ;;
-        SOGO_URL_ENCRYPTION_KEY)
-            echo '# SOGo URL encryption key (exactly 16 characters, limited to A–Z, a–z, 0–9)' >> mailcow.conf
-            echo '# This key is used to encrypt email addresses within SOGo URLs' >> mailcow.conf
-            echo "SOGO_URL_ENCRYPTION_KEY=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2>/dev/null | head -c 16)" >> mailcow.conf
-            ;;
         *)
             echo "${option}=" >> mailcow.conf
             ;;
diff --git a/docker-compose.yml b/docker-compose.yml
index f09afca2a..952f10f08 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -213,7 +213,6 @@ services:
         - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
         - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
         - SOGO_EXPIRE_SESSION=${SOGO_EXPIRE_SESSION:-480}
-        - SOGO_URL_ENCRYPTION_KEY=${SOGO_URL_ENCRYPTION_KEY:-SOGoSuperSecret0}
         - SKIP_SOGO=${SKIP_SOGO:-n}
         - MASTER=${MASTER:-y}
         - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
diff --git a/generate_config.sh b/generate_config.sh
index 393d2fced..fe8832452 100755
--- a/generate_config.sh
+++ b/generate_config.sh
@@ -405,10 +405,6 @@ MAILDIR_SUB=Maildir
 # SOGo session timeout in minutes
 SOGO_EXPIRE_SESSION=480
 
-# SOGo URL encryption key (exactly 16 characters, limited to A–Z, a–z, 0–9)
-# This key is used to encrypt email addresses within SOGo URLs
-SOGO_URL_ENCRYPTION_KEY=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2>/dev/null | head -c 16)
-
 # DOVECOT_MASTER_USER and DOVECOT_MASTER_PASS must both be provided. No special chars.
 # Empty by default to auto-generate master user and password on start.
 # User expands to DOVECOT_MASTER_USER@mailcow.local