diff --git a/.env.example b/.env.example
index 1293563..a279367 100644
--- a/.env.example
+++ b/.env.example
@@ -15,7 +15,6 @@ SSL_CERTIFICATE_DIR=./config/letsencrypt/live/broker.example.com
 SSL_CERTIFICATE_FILE=fullchain.pem
 SSL_CERTIFICATE_KEY_FILE=privkey.pem
 
-TAPM_LISTEN_ADDR=:8080
 TAPM_DATABASE_DSN=file:/data/tapm.db?_pragma=busy_timeout(5000)&_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)
 TAPM_PUBLIC_URL=https://broker.example.com
 TAPM_GITEA_URL=https://git.example.com
diff --git a/docs/deployment.md b/docs/deployment.md
index 1b2f2b5..a322879 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -94,12 +94,14 @@ the repository or at an absolute host path.
 Create the initial Gitea administrator:
 
 ```sh
-docker compose exec gitea \
-  gitea admin user create \
-  --admin --username taiadmin --email ADMIN-EMAIL \
-  --password 'TEMPORARY-RANDOM-PASSWORD' --must-change-password
+./manage.sh create-admin
 ```
 
+No Gitea login is hard-coded or stored in `.env`. The command prompts for the
+administrator username and email, generates a temporary password, and requires
+it to be changed at first login. The initial web installer is intentionally
+locked and public registration is disabled.
+
 Sign in to Gitea at `https://GITEA_DOMAIN`, create the `TAI` organization, and
 create:
 
diff --git a/manage.sh b/manage.sh
index 25bbb6e..f86a769 100755
--- a/manage.sh
+++ b/manage.sh
@@ -109,6 +109,29 @@ start-direct)
 		-f compose.direct.yaml \
 		up -d --build
 	;;
+create-admin)
+	require_env
+	command -v openssl >/dev/null 2>&1 ||
+		fail "openssl is required to generate the temporary password"
+	printf 'Gitea administrator username [taiadmin]: '
+	read -r admin_username
+	admin_username="${admin_username:-taiadmin}"
+	printf 'Gitea administrator email: '
+	read -r admin_email
+	[[ -n "$admin_email" ]] || fail "an administrator email is required"
+	temporary_password="$(openssl rand -base64 24)"
+	docker compose exec -T gitea gitea admin user create \
+		--admin \
+		--username "$admin_username" \
+		--email "$admin_email" \
+		--password "$temporary_password" \
+		--must-change-password
+	printf '\nGitea administrator created.\n'
+	printf 'Username: %s\n' "$admin_username"
+	printf 'Temporary password: %s\n' "$temporary_password"
+	printf 'Sign in at https://%s/ and change the password immediately.\n' \
+		"$GITEA_DOMAIN"
+	;;
 renew)
 	require_env
 	[[ "$SSL_MODE" == "letsencrypt" ]] ||
@@ -133,7 +156,7 @@ status)
 	docker compose -f compose.yaml -f compose.tls.yaml ps
 	;;
 *)
-	printf 'Usage: %s {prepare|bootstrap|start|start-direct|renew|backup|status}\n' "$0"
+	printf 'Usage: %s {prepare|bootstrap|start|start-direct|create-admin|renew|backup|status}\n' "$0"
 	exit 2
 	;;
 esac