diff --git a/src/runboat/kubefiles/runboat-start.sh b/src/runboat/kubefiles/runboat-start.sh
index 8fe8825..ef67bbd 100755
--- a/src/runboat/kubefiles/runboat-start.sh
+++ b/src/runboat/kubefiles/runboat-start.sh
@@ -14,6 +14,9 @@ fi
 # show what is installed (the venv in /opt/odoo-venv has been mounted)
 pip list
 
+# Make sure users cannot create databases.
+echo "admin_passwd=$(python3 -c 'import secrets; print(secrets.token_hex())')" >> ${ODOO_RC}
+
 # Add ADDONS_DIR to addons_path (because that oca_install_addons did,
 # but $ODOO_RC is not on a persistent volume, so it is lost when we
 # start in another container).