diff --git a/.gitignore b/.gitignore
index 594d958..adc2474 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,9 @@
 # Local development sandbox (posts, generated config)
 /.volumen/
 
+# Local dev config (contains password hash)
+/config.toml
+
 # Uploaded media in the dev content directory
 /posts/media/
 
diff --git a/config.toml b/config.toml.example
similarity index 54%
rename from config.toml
rename to config.toml.example
index 34f734d..31b60e3 100644
--- a/config.toml
+++ b/config.toml.example
@@ -1,5 +1,5 @@
 # Local development configuration for `just dev`.
-# Not shipped with the gem; safe to edit. Keep real admin hashes out of Git.
+# Copy to config.toml and adjust. Keep real admin hashes out of Git.
 
 [server]
 host = "127.0.0.1"
@@ -16,8 +16,7 @@ language = "cs"
 author = "Petr Balvín"
 
 [admin]
-# Dev credentials: password is "admin". Replace before any real use
-# (generate with `volumen hash-password`).
-password_hash = "scrypt$16384$8$1$I7XEC8EpyfaptaPxmBQSUg==$gK7TRZAJnYmOSfKJ7xg+cOaYeBV4r5jlqcoL5+jNlSs="
+# Generate a hash with: bundle exec exe/volumen hash-password
+password_hash = ""
 session_key = ""
 session_ttl = 86400