diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9552173a..e73b62eb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -86,6 +86,7 @@ the frozen-backend fallback mirror it for their toolchains.
 
 ### Docs
 
+- PowerShell Docker setup now generates the administrator key without requiring Python on the host (#1993) — thanks @yangfan-yf-yf!
 - Docker quick starts now explain the AMD64-only images and direct Apple Silicon users to the native macOS app (#1921) — thanks @yangfan-yf-yf!
 - audio.cpp (Breeze-TTS-2) is now a documented opt-in engine: prebuilt binary install, explicit GGUF download, voice modes, and the weights' research/non-commercial terms (#1891)
 - `docs/STRUCTURE.md` describes the tree as it is today, and a test now keeps its counts honest (#1981) — thanks @Dawcraft!
diff --git a/docs/install/docker.md b/docs/install/docker.md
index 99f9aef9..2b4de837 100644
--- a/docs/install/docker.md
+++ b/docs/install/docker.md
@@ -273,7 +273,15 @@ docker compose -f deploy/docker-compose.yml --profile rocm up -d
 > session before running the same two commands:
 >
 > ```powershell
-> $env:OMNIVOICE_API_KEY = python -c "import secrets; print(secrets.token_urlsafe(32))"
+> $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+> try {
+>     $keyBytes = New-Object byte[] 32
+>     $rng.GetBytes($keyBytes)
+>     $env:OMNIVOICE_API_KEY = [Convert]::ToBase64String($keyBytes)
+> }
+> finally {
+>     $rng.Dispose()
+> }
 > $env:DOCKER_DEFAULT_PLATFORM = 'linux/amd64'
 > docker compose -f deploy/docker-compose.yml --profile cpu pull
 > docker compose -f deploy/docker-compose.yml --profile cpu up -d