diff --git a/CHANGELOG.md b/CHANGELOG.md
index aeb8439..2d5c1ae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,6 +28,8 @@
   but it ensures that PKs cannot be resued. (#143)
 + The REST API for `DataPoint` has been implemented. (#122)
 + Example `docker-compose.yml` file now includes `depends_on`. (#99)
++ A tip on generating a secure secret has been added to the installation
+  docs. (#93)
 
 
 ## 0.5.0 (2019-02-28)
diff --git a/docs/installation.rst b/docs/installation.rst
index 45ceae5..a815563 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -63,6 +63,20 @@ following is needed:
    SECRET_KEY = b"don't use the value written in this README file!"
    DATABASE = "/data/internal.db"
 
+.. tip::
+
+   You can generate a secure secret key from the shell like so:
+
+   .. code-block:: python
+
+      >>> import os
+      >>> import binascii
+      >>> binascii.hexlify(os.urandom(32))
+      b'<some string of hex [0-9a-f]>'
+
+   Which you can then copy into ``trendlines.cfg``'s ``SECRET_KEY`` field.
+   Don't forget the leading ``b``!
+
 You should be all set to bring Docker Compose up:
 
 .. code-block:: bash