diff --git a/Makefile b/Makefile
index 6b62ef1..d5377e0 100644
--- a/Makefile
+++ b/Makefile
@@ -32,6 +32,10 @@ agent-linux: ## Cross-build agent for linux-amd64 (consumed by live-image build)
 gen-admin-password: ## Build the bcrypt password generator
 	go build -o bin/gen-admin-password$(if $(filter Windows%,$(UNAME_S)),.exe,) ./tools/gen-admin-password
 
+.PHONY: gen-admin-password-linux
+gen-admin-password-linux: ## Cross-build the bcrypt password generator for linux-amd64
+	$(GOOS_LINUX) go build -ldflags="$(LDFLAGS)" -o bin/gen-admin-password-linux-amd64 ./tools/gen-admin-password
+
 .PHONY: tidy
 tidy: ## go mod tidy
 	go mod tidy
diff --git a/deploy/install.sh b/deploy/install.sh
index 10dddfd..0df4dc9 100644
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -95,6 +95,20 @@ install -d -m 0755 "${CONFIG_DIR}"
 echo "==> installing binary"
 install -m 0755 "${BINARY}" /usr/local/bin/vetting
 
+# Install the bcrypt password generator too if we can find it — the
+# operator needs it to fill in auth.admin_password_bcrypt.
+GEN_PW=""
+for cand in \
+    "${REPO_ROOT}/bin/gen-admin-password-linux-amd64" \
+    "${REPO_ROOT}/bin/gen-admin-password" \
+    "${SCRIPT_DIR}/gen-admin-password"; do
+    if [[ -x "${cand}" ]]; then GEN_PW="${cand}"; break; fi
+done
+if [[ -n "${GEN_PW}" ]]; then
+    echo "==> installing gen-admin-password"
+    install -m 0755 "${GEN_PW}" /usr/local/bin/gen-admin-password
+fi
+
 echo "==> installing config and systemd unit"
 if [[ ! -f "${CONFIG_DIR}/vetting.yaml" ]]; then
     install -m 0640 -o root -g "${SERVICE_USER}" \
@@ -123,7 +137,7 @@ vetting is installed but not yet enabled.
 
 Next steps:
   1. Edit ${CONFIG_DIR}/vetting.yaml and set:
-       - auth.admin_password_bcrypt  (run: vetting gen-admin-password YOURPW)
+       - auth.admin_password_bcrypt  (run: gen-admin-password 'YOURPW')
        - auth.session_secret_hex     (run: openssl rand -hex 32)
        - server.public_url           (the URL you'll browse to)
        - pxe.* if you want PXE boot support
diff --git a/deploy/proxmox-install.sh b/deploy/proxmox-install.sh
index bfcf3a1..9de6534 100644
--- a/deploy/proxmox-install.sh
+++ b/deploy/proxmox-install.sh
@@ -65,9 +65,9 @@ fi
 echo "==> installing templ ${TEMPL_VERSION}"
 GOBIN=/usr/local/bin go install "github.com/a-h/templ/cmd/templ@${TEMPL_VERSION}"
 
-echo "==> building orchestrator (make orchestrator-linux)"
+echo "==> building orchestrator + gen-admin-password"
 cd "${SRC_DIR}"
-make orchestrator-linux
+make orchestrator-linux gen-admin-password-linux
 
 echo "==> running deploy/install.sh"
 bash deploy/install.sh --binary "bin/vetting-linux-amd64"