diff --git a/TODO.on.site b/TODO.on.site
index 56a0960..da83a0e 100644
--- a/TODO.on.site
+++ b/TODO.on.site
@@ -1,3 +1,8 @@
+Create secret seed:
+We use a single secret seed that internal passwords (e.g.
+robot mail accounts, databases) are derived from.
+* `dd if=/dev/urandom bs=1 count=16 | base 64 >.seed`
+
 Create environment files (cf. `git ls-files \*environment.template`):
 * Set SA_PUBLIC_DOMAIN_NAME in `environment`
 * Set CANONICAL_WEB_URL in `gerrit/environment`