diff --git a/scripts/keygen.py b/scripts/keygen.py
new file mode 100644
index 0000000..65c0c59
--- /dev/null
+++ b/scripts/keygen.py
@@ -0,0 +1,5 @@
+#!/usr/bin/env python3
+# Generate a fresh HMAC key for signing telemetry packets.
+# Prints the key once; store it in the collector's .env yourself.
+import os, base64
+print(base64.b64encode(os.urandom(32)).decode())