diff --git a/CHANGELOG.md b/CHANGELOG.md
index d58c0ce1..eb8324f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - EPG table "Updated" column now updates in real-time via WebSocket using the actual backend timestamp instead of requiring a page refresh
 - Bulk channel editor confirmation dialog now displays the correct stream profile name that will be applied to the selected channels.
 
+## [0.13.1] - 2025-12-06
+
+### Fixed
+
 ## [0.13.0] - 2025-12-02
 
 ### Added
diff --git a/dispatcharr/settings.py b/dispatcharr/settings.py
index d6c29dd9..5f8c23e2 100644
--- a/dispatcharr/settings.py
+++ b/dispatcharr/settings.py
@@ -4,7 +4,7 @@ from datetime import timedelta
 
 BASE_DIR = Path(__file__).resolve().parent.parent
 
-SECRET_KEY = "REPLACE_ME_WITH_A_REAL_SECRET"
+SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY")
 REDIS_HOST = os.environ.get("REDIS_HOST", "localhost")
 REDIS_DB = os.environ.get("REDIS_DB", "0")
 
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index fa0eea01..9c3ec88c 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -40,6 +40,22 @@ export REDIS_DB=${REDIS_DB:-0}
 export DISPATCHARR_PORT=${DISPATCHARR_PORT:-9191}
 export LIBVA_DRIVERS_PATH='/usr/local/lib/x86_64-linux-gnu/dri'
 export LD_LIBRARY_PATH='/usr/local/lib'
+export SECRET_FILE="/data/jwt"
+
+if [ ! -f "$SECRET_FILE" ]; then
+  umask 077
+  tmpfile="$(mktemp "${SECRET_FILE}.XXXXXX")" || { echo "mktemp failed"; exit 1; }
+  python3 - <<'PY' >"$tmpfile" || { echo "secret generation failed"; rm -f "$tmpfile"; exit 1; }
+import secrets
+print(secrets.token_urlsafe(64))
+PY
+  mv -f "$tmpfile" "$SECRET_FILE" || { echo "move failed"; rm -f "$tmpfile"; exit 1; }
+fi
+
+chown $PUID:$PGID "$SECRET_FILE" || true
+chmod 600 "$SECRET_FILE" || true
+
+export DJANGO_SECRET_KEY="$(cat "$SECRET_FILE")"
 
 # Process priority configuration
 # UWSGI_NICE_LEVEL: Absolute nice value for uWSGI/streaming (default: 0 = normal priority)
@@ -90,7 +106,7 @@ if [[ ! -f /etc/profile.d/dispatcharr.sh ]]; then
         DISPATCHARR_ENV DISPATCHARR_DEBUG DISPATCHARR_LOG_LEVEL
         REDIS_HOST REDIS_DB POSTGRES_DIR DISPATCHARR_PORT
         DISPATCHARR_VERSION DISPATCHARR_TIMESTAMP LIBVA_DRIVERS_PATH LIBVA_DRIVER_NAME LD_LIBRARY_PATH
-        CELERY_NICE_LEVEL UWSGI_NICE_LEVEL
+        CELERY_NICE_LEVEL UWSGI_NICE_LEVEL DJANGO_SECRET_KEY
     )
 
     # Process each variable for both profile.d and environment
diff --git a/version.py b/version.py
index b27fed86..f017df85 100644
--- a/version.py
+++ b/version.py
@@ -1,5 +1,5 @@
 """
 Dispatcharr version information.
 """
-__version__ = '0.13.0'  # Follow semantic versioning (MAJOR.MINOR.PATCH)
+__version__ = '0.13.1'  # Follow semantic versioning (MAJOR.MINOR.PATCH)
 __timestamp__ = None    # Set during CI/CD build process