diff --git a/pkg/options/auth.go b/pkg/options/auth.go
index 07d27f00d..720e610bf 100644
--- a/pkg/options/auth.go
+++ b/pkg/options/auth.go
@@ -1,12 +1,18 @@
 package options
 
 import (
-	"github.com/cortezaproject/corteza-server/pkg/rand"
+	"crypto/md5"
+	"fmt"
 )
 
 func (o *AuthOpt) Defaults() {
-
 	if o.Secret == "" {
-		o.Secret = string(rand.Bytes(32))
+		// if JWT secret is empty generate it from virtualhost/hostname and DB_DSN value.
+		// this will keep the secret the same through restarts
+		o.Secret = EnvString("DB_DSN", "memory")
+		// pick one of the env that holds hostname
+		o.Secret += EnvString("HOSTNAME", "localhost")
+
+		o.Secret = fmt.Sprintf("%x", md5.Sum([]byte(o.Secret)))
 	}
 }
diff --git a/pkg/options/auth.yaml b/pkg/options/auth.yaml
index 12d1904ba..bf025803e 100644
--- a/pkg/options/auth.yaml
+++ b/pkg/options/auth.yaml
@@ -12,8 +12,8 @@ props:
 
       [IMPORTANT]
       ====
-      Make sure to provide a secret.
-      If you don't, a random value is assigned -- this causes all of the tokens to become invalid after a server restart.
+      If JWT secret is not set, system auto-generates one from DB_DSN and HOSTNAME environment variables.
+      Generated secret will change if you change any of variables.
       ====
 
   - name: expiry