diff --git a/etc/fetch_prole_secrets.sh b/etc/fetch_prole_secrets.sh
index e302ccc..3e2d10c 100755
--- a/etc/fetch_prole_secrets.sh
+++ b/etc/fetch_prole_secrets.sh
@@ -10,7 +10,7 @@
 #
 # Cookie secret:
 #   If already stored as field 'cookie_secret' in db-prole-org, uses that.
-#   Otherwise generates a new 32-byte base64 secret, writes it to
+#   Otherwise generates a 32-char base64 secret (openssl rand -base64 24 → 32 chars = 32 bytes, valid for AES), writes it to
 #   etc/secrets/oauth2-proxy-cookie-secret-prole, and saves it back to the
 #   db-prole-org item so it's durable in 1Password.
 #
@@ -78,7 +78,7 @@ COOKIE_SECRET="$(op item get "db-prole-org" --fields label=cookie_secret --revea
 
 if [[ -z "$COOKIE_SECRET" ]]; then
   log "  No cookie_secret field in db-prole-org — generating new 32-byte secret ..."
-  COOKIE_SECRET="$(openssl rand -base64 32)"
+  COOKIE_SECRET="$(openssl rand -base64 24)"
 
   log "  Saving cookie_secret back to db-prole-org in 1Password ..."
   op item edit "db-prole-org" \