diff --git a/example-config.yaml b/example-config.yaml
index 1d5cfdb7..eb6c57d8 100644
--- a/example-config.yaml
+++ b/example-config.yaml
@@ -41,7 +41,7 @@ appservice:
         # The prefix to use in the provisioning API endpoints.
         prefix: /_matrix/provision
         # The shared secret to authorize users of the API.
-        # You can generate a decent secret with `pwgen -snc 32 1`
+        # If you leave the default token, a random token will be generated and saved at startup.
         shared_secret: "Very secret shared secret"
 
     # The unique ID of this appservice.
diff --git a/mautrix_telegram/config.py b/mautrix_telegram/config.py
index 07944b3c..facb4806 100644
--- a/mautrix_telegram/config.py
+++ b/mautrix_telegram/config.py
@@ -162,6 +162,8 @@ class Config(DictWithRecursion):
         copy("appservice.provisioning.enabled")
         copy("appservice.provisioning.prefix")
         copy("appservice.provisioning.shared_secret")
+        if base["appservice.provisioning.shared_secret"] == "Very secret shared secret":
+            base["appservice.provisioning.shared_secret"] = self._new_token()
 
         copy("appservice.id")
         copy("appservice.bot_username")