diff --git a/platform/vuln-scanner/README.md b/platform/vuln-scanner/README.md
index 5547af6..b5f8b1e 100644
--- a/platform/vuln-scanner/README.md
+++ b/platform/vuln-scanner/README.md
@@ -31,7 +31,7 @@ In one PR (the realm import does not re-run on its own for a NEW client):
 
    ```bash
    ./infra/devcontainer/dev.sh run bash -c '
-     cs=$(openssl rand -hex 32)
+     cs=$(python3 -c "import secrets; print(secrets.token_hex(32))")
      sops set platform/keycloak/keycloak-realm-clients.sops.yaml \
        "[\"stringData\"][\"vuln-scanner-client-secret\"]" "\"$cs\""
      sops set platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml \
diff --git a/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml b/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml
new file mode 100644
index 0000000..731d484
--- /dev/null
+++ b/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: vuln-scanner-oauth2-proxy
+    namespace: vuln-scanner
+type: Opaque
+stringData:
+    client-id: ENC[AES256_GCM,data:9n9fMQyIq+JmfgXy,iv:8FLkOTc6Rmck33ecd4A3DXP2CiGrAkxMJ8Q7nmI9naE=,tag:4wb8rAXx+KAIhWAviEKTJQ==,type:str]
+    client-secret: ENC[AES256_GCM,data:JQCSBroPwd1KxZhdOw9zYkA9krYdK79QpnP/WW3ZIYVoyvHGVKJ2OVPpvgtWy20Ex0yWCTtmpghn87r+4Kkrfw==,iv:RFuDweYB7z5fykB/Ued2Z7MdO9VVY2XoO4gwekxMo0U=,tag:UseTecg5dJMNR1SN6ZUZ7g==,type:str]
+    cookie-secret: ENC[AES256_GCM,data:F7McZBTr10fnpTEz8cYjXsvrwRgqiKrlcaL/mSZKjOjuPfaSvq4sV3YBuQc=,iv:2vDEqmUHFFpUsRkBSqj3X92eT2bP8VTj2BiAr/8+7ak=,tag:rdHVky9JmlcEEhsxV6OtnA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGdGErRzEvQWNTcUdYanhG
+            RGVaYi9CdDNvYVdhL2ViOWI4Z3k0M2pxb0V3ClgzOFNPRXdyZ1pVZTFKMVEyTGVV
+            bkxQWDdFZUtvME1jZm9VUXBHaVpHM3cKLS0tIDhodHlQVUNhNlpiVFAzU1JZL2d3
+            cUhWcGNGSThYTkRaV0NSOUZrM2ZmS1UKjFe6iGia0+QOZgWcSFoH0LLEp1f2M2ds
+            V8bIBIFTtRDTKp6kgt0nee+Sgb7g5D5NIGTrRDGE256I8jdiNDcMpw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-11-09T15:43:11Z"
+    mac: ENC[AES256_GCM,data:jXBQdruY8yLD4k3iRHqn78Pq0iXzETDk/S8qyXSVFHsacqUvmtzdOw6ajJDg7hAkVGN9PXqH+lsz45wR3a3YVODbQZJyS0+cKuQ1cVWlV/wcWOlNSdeKSLRe8h658KjXGUPQubaDFB4rloBfUr5ebuGQGr4ZEj7g241xjrsjBic=,iv:asoMnTjsIIb1AgrgE9dERixbpw94TpQWCPRwAT3mXYM=,tag:uwCVmjDr3gDQAqWsmiF0tA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4
diff --git a/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml.example b/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml.example
index ff03df3..4edf210 100644
--- a/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml.example
+++ b/platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml.example
@@ -9,7 +9,8 @@
 #
 # Regenerate (encrypts to the repo's public recipient via .sops.yaml, values never echoed):
 #   ./infra/devcontainer/dev.sh run bash -c '
-#     cs=$(openssl rand -hex 32); ck=$(openssl rand -base64 32 | tr -- "+/" "-_")
+#     cs=$(python3 -c "import secrets; print(secrets.token_hex(32))")
+#     ck=$(python3 -c "import base64,os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())")
 #     sops -e --input-type yaml --output-type yaml \
 #       --filename-override platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml \
 #       /dev/stdin <<YAML > platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml