diff --git a/containers/code-server.yml b/containers/code-server.yml
index 2fa0497..4ecfdfd 100644
--- a/containers/code-server.yml
+++ b/containers/code-server.yml
@@ -1,6 +1,6 @@
 # code-server: VS Code in the browser
 # Image: linuxserver/code-server - lightweight, s6 overlay, PUID/PGID support
-# Access: http://<host>:8443  (set PASSWORD in Portainer stack env)
+# Access: http://<host>:8443  Set PASSWORD in yml or Portainer stack env; if empty, one is generated and saved to /config/.password-generated (and logged on first run).
 version: "3.8"
 
 services:
@@ -23,6 +23,19 @@ services:
       - code-server-workspace:/config/workspace
     cap_add:
       - NET_BIND_SERVICE
+    command: >
+      sh -c '
+      if [ -z "$$PASSWORD" ]; then
+        if [ -f /config/.password-generated ]; then
+          export PASSWORD=$$(cat /config/.password-generated);
+        else
+          export PASSWORD=$$(openssl rand -hex 16);
+          echo "$$PASSWORD" > /config/.password-generated;
+          echo "Generated code-server password (saved in /config/.password-generated): $$PASSWORD";
+        fi;
+      fi;
+      exec /init
+      '
 
 volumes:
   code-server-config: