diff --git a/karakeep/rootfs/etc/cont-init.d/91-secrets.sh b/karakeep/rootfs/etc/cont-init.d/91-secrets.sh
index 2af5e269a..b22cfd2e7 100755
--- a/karakeep/rootfs/etc/cont-init.d/91-secrets.sh
+++ b/karakeep/rootfs/etc/cont-init.d/91-secrets.sh
@@ -1,9 +1,13 @@
-#!/command/with-contenv bashio
+#!/usr/bin/with-contenv bashio
 # shellcheck shell=bash
 set -e
 
 generate_secret() {
-  tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 64
+  # Avoid SIGPIPE from `tr` when `head` terminates early under pipefail.
+  (
+    set +o pipefail 2>/dev/null || true
+    tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 64
+  )
 }
 
 set_option() {