diff --git a/bazarr/app.py b/bazarr/app.py
index 31eb6be3e..0765841e4 100644
--- a/bazarr/app.py
+++ b/bazarr/app.py
@@ -5,7 +5,7 @@ from flask_socketio import SocketIO
 import os
 
 from get_args import args
-from config import base_url
+from config import settings, base_url
 
 socketio = SocketIO()
 
@@ -19,7 +19,7 @@ def create_app():
     app.wsgi_app = ReverseProxied(app.wsgi_app)
     app.route = prefix_route(app.route, base_url.rstrip('/'))
 
-    app.config["SECRET_KEY"] = 'test'
+    app.config["SECRET_KEY"] = settings.general.flask_secret_key
     app.config['JSONIFY_PRETTYPRINT_REGULAR'] = True
     app.config['JSON_AS_ASCII'] = False
 
diff --git a/bazarr/init.py b/bazarr/init.py
index c9058a912..e2f37336a 100644
--- a/bazarr/init.py
+++ b/bazarr/init.py
@@ -71,6 +71,13 @@ if not settings.auth.apikey or settings.auth.apikey.startswith("b'"):
     with open(os.path.join(args.config_dir, 'config', 'config.ini'), 'w+') as handle:
         settings.write(handle)
 
+# create random Flask secret_key if there's none in config.ini
+if not settings.general.flask_secret_key:
+    from binascii import hexlify
+    settings.general.flask_secret_key = hexlify(os.urandom(16)).decode()
+    with open(os.path.join(args.config_dir, 'config', 'config.ini'), 'w+') as handle:
+        settings.write(handle)
+
 # change default base_url to ''
 if settings.general.base_url == '/':
     settings.general.base_url = ''