diff --git a/1687801090_sutty_initial_admin.js b/1687801090_sutty_initial_admin.js
new file mode 100644
index 0000000..db9f33e
--- /dev/null
+++ b/1687801090_sutty_initial_admin.js
@@ -0,0 +1,28 @@
+// https://pocketbase.io/docs/js-migrations/#creating-new-admin
+const email = "pocketbase@sutty.nl";
+migrate(
+  (db) => {
+    const dao = new Dao(db);
+
+    const adminPwEnv = $os.getenv("ADMIN_PASSWORD");
+    if (adminPwEnv) {
+      const admin = new Admin();
+      admin.email = email;
+      admin.setPassword(adminPwEnv);
+
+      dao.saveAdmin(admin);
+    }
+  },
+  (db) => {
+    // optional revert
+    const dao = new Dao(db);
+
+    try {
+      const admin = dao.findAdminByEmail("pocketbase@sutty.nl");
+
+      dao.deleteAdmin(admin);
+    } catch (_) {
+      /* most likely already deleted */
+    }
+  },
+);
diff --git a/Dockerfile b/Dockerfile
index a6dde9a..7c15475 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,9 +13,10 @@ FROM gitea.nulo.in/sutty/sutty:${ALPINE_VERSION}
 MAINTAINER "nulo <nulo@sutty.nl>"
 
 COPY --from=build /pb/pocketbase /usr/local/bin/pocketbase
+COPY 1687801090_sutty_initial_admin.js /pb/pb_migrations/
 
 WORKDIR /pb
 VOLUME /pb/pb_data
 VOLUME /pb/pb_migrations
-CMD ["/usr/local/bin/pocketbase", "serve", "--http=0.0.0.0:8080"]
+CMD ["pocketbase", "serve", "--http=0.0.0.0:8080", "--automigrate"]
 EXPOSE 8080
\ No newline at end of file
diff --git a/readme.md b/readme.md
index 90595f7..1c61ee5 100644
--- a/readme.md
+++ b/readme.md
@@ -1,3 +1,7 @@
 # sutty/containers-pocketbase
 
 A small container with the standalone [PocketBase](https://github.com/pocketbase/pocketbase) binary.
+
+## ADMIN_PASSWORD
+
+Set the `ADMIN_PASSWORD` env variable **in the first start** to generate an admin account with the email `pocketbase@sutty.nl` and that password. This will prevent the installer from running, which allows anyone that can access the PocketBase instance to create an initial admin account.