diff --git a/Dockerfile b/Dockerfile
index f9cf5728..cf7af7dc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,10 @@
 FROM denoland/deno:1.44.2
 
+ARG DITTO_NSEC
 ARG DITTO_DOMAIN
 ARG DITTO_UPLOADER_CONFIG
 
+ENV DITTO_NSEC=${DITTO_NSEC}
 ENV DITTO_DOMAIN=${DITTO_DOMAIN}
 ENV DITTO_UPLOADER_CONFIG=${DITTO_UPLOADER_CONFIG}
 ENV PORT 5000
@@ -12,4 +14,5 @@ RUN mkdir -p data
 COPY . .
 RUN deno cache src/server.ts
 RUN deno task headless:setup
+RUN deno task soapbox
 CMD deno task start
diff --git a/scripts/headless/setup.ts b/scripts/headless/setup.ts
index 21d344b2..8e77120d 100644
--- a/scripts/headless/setup.ts
+++ b/scripts/headless/setup.ts
@@ -1,4 +1,3 @@
-import { generateSecretKey, nip19 } from 'nostr-tools';
 import { parseUploaderConfig } from './uploader-config.ts';
 
 function scream(...args: any[]) {
@@ -11,9 +10,8 @@ function missingEnv(what: string, v: string) {
 }
 
 if (import.meta.main) {
-  const key = generateSecretKey();
-  const DITTO_NSEC = nip19.nsecEncode(key);
-  console.log('DITTO_NSEC: ', DITTO_NSEC);
+  const DITTO_NSEC = Deno.env.get('DITTO_NSEC');
+  if (!DITTO_NSEC) missingEnv('Ditto instance nsec', 'DITTO_NSEC');
 
   const LOCAL_DOMAIN = Deno.env.get('DITTO_DOMAIN');
   if (!LOCAL_DOMAIN) missingEnv('Domain value', 'DITTO_DOMAIN');