diff --git a/wger/CHANGELOG.md b/wger/CHANGELOG.md
index 7f9cd8024d..d00b819d52 100644
--- a/wger/CHANGELOG.md
+++ b/wger/CHANGELOG.md
@@ -1,6 +1,8 @@
 ## 2.8.0-dev.1.1 (2026-10-16)
 
 - Fix blank dashboard and non-working menus caused by 404s on frontend assets (bootstrap, htmx, fontawesome, react components). Upstream's entrypoint only collects static files when `DJANGO_DEBUG` is explicitly `False`, which the add-on never set; it is now set in the image (#3123).
+- Set `DJANGO_DEBUG=False` in the default `env_vars` option for new installs; the image keeps it as a fallback for existing installs, whose options are not updated.
+- Generate `SECRET_KEY`, `JWT_PRIVATE_KEY` and `JWT_PUBLIC_KEY` on first start and store them in `/data/secrets.env`. This fixes the wger mobile app login failing with a 500 error, and keeps web sessions across restarts. Values set through `env_vars` still take precedence.
 
 ## 2.8.0-dev.1 (2026-10-10)
 - Update to latest version from wger/server
diff --git a/wger/config.yaml b/wger/config.yaml
index 5074d55610..916b44ca6f 100644
--- a/wger/config.yaml
+++ b/wger/config.yaml
@@ -10,7 +10,9 @@ map:
   - ssl:ro
 name: Wger
 options:
-  env_vars: []
+  env_vars:
+    - name: DJANGO_DEBUG
+      value: "False"
   CONFIG_LOCATION: /config/config.yaml
 ports:
   80/tcp: 9927
diff --git a/wger/rootfs/etc/cont-init.d/90-run.sh b/wger/rootfs/etc/cont-init.d/90-run.sh
index d479f2e9a7..258b3fcf93 100755
--- a/wger/rootfs/etc/cont-init.d/90-run.sh
+++ b/wger/rootfs/etc/cont-init.d/90-run.sh
@@ -68,21 +68,33 @@ prepare_writable_dir /data/static
 prepare_writable_dir /data/media
 migrate_database
 
+echo "... generate persistent secrets"
+# Without JWT keys the mobile app login fails with a 500, and without SECRET_KEY
+# sessions are lost at every restart. Generated once, env_vars still override them.
+if ! grep -qs '^JWT_PRIVATE_KEY=' /data/secrets.env; then
+    {
+        echo "SECRET_KEY=$(python3 -c 'import secrets; print(secrets.token_urlsafe(50))')"
+        (cd /home/wger/src && sudo -u wger -E HOME=/home/wger python3 manage.py generate-jwt-keys 2> /dev/null | grep '^JWT_')
+    } > /data/secrets.env || bashio::log.warning "Unable to generate JWT keys"
+    chmod 600 /data/secrets.env
+fi
+
 echo "... add env variables"
 (
     set -o posix
     export -p
 ) > /data/env.sh
 
-if [ -f /.env ]; then
+for envfile in /data/secrets.env /.env; do
+    [ -f "$envfile" ] || continue
     while IFS= read -r line; do
         [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue
         var="${line%%=*}"
         [[ "$var" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
         sed -i "/^export[[:space:]]\+$var=/d" /data/env.sh
         echo "export $line" >> /data/env.sh
-    done < /.env
-fi
+    done < "$envfile"
+done
 
 chown wger /data/env.sh || bashio::log.warning "Unable to set /data/env.sh ownership to wger"
 chmod 0644 /data/env.sh || bashio::log.warning "Unable to make /data/env.sh readable"