diff --git a/Rocket.toml b/Rocket.toml
deleted file mode 100644
index 293fd72..0000000
--- a/Rocket.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-[default]
-secret_key = "MHSePvm1msyOkYuJ7u+MtyJYCzgdHCS7QNvrk9ts+rI="
diff --git a/justfile b/justfile
index 8c161a2..8d4bf6e 100644
--- a/justfile
+++ b/justfile
@@ -1,6 +1,11 @@
 _default:
     @just --list
 
+export SECRET_KEY := "MHSePvm1msyOkYuJ7u+MtyJYCzgdHCS7QNvrk9ts+rI="
+
+[doc("Run the reader locally in demo mode.")] # don't re-use this secret key
+run-local-demo:
+    cargo run -- --demo
 
 sqlx-prepare:
     DATABASE_URL="sqlite:data.sqlite" cargo sqlx prepare
diff --git a/src/main.rs b/src/main.rs
index 1baddc1..28a90ff 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -99,7 +99,9 @@ fn rocket() -> _ {
         format!("sqlite:{}", database)
     };
 
-    let figment = rocket::Config::figment().merge(("databases.rss_data.url", db_url));
+    let figment = rocket::Config::figment()
+        .merge(("databases.rss_data.url", db_url))
+        .merge(("secret_key", std::env::var("SECRET_KEY").expect("SECRET_KEY environment variable must be set")));
 
     rocket::custom(figment)
         .mount(