diff --git a/copy/tmp/kumquat-settings.py b/copy/tmp/kumquat-settings.py
new file mode 100644
index 0000000..15822de
--- /dev/null
+++ b/copy/tmp/kumquat-settings.py
@@ -0,0 +1,61 @@
+"""
+Django settings for kumquat_web project.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/1.6/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/1.6/ref/settings/
+"""
+
+# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
+import os
+BASE_DIR = os.path.dirname(os.path.dirname(__file__))
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = False
+TEMPLATE_DEBUG = False
+ALLOWED_HOSTS = []
+
+# Application definition
+
+INSTALLED_APPS = (
+	'django.contrib.admin',
+	'django.contrib.auth',
+	'django.contrib.contenttypes',
+	'django.contrib.sessions',
+	'django.contrib.messages',
+	'django.contrib.staticfiles',
+	'bootstrap3',
+	'kumquat',
+	'web',
+	'mysql',
+	'ftp',
+	'status',
+)
+
+MIDDLEWARE_CLASSES = (
+	'django.contrib.sessions.middleware.SessionMiddleware',
+	'django.middleware.common.CommonMiddleware',
+	'django.middleware.csrf.CsrfViewMiddleware',
+	'django.contrib.auth.middleware.AuthenticationMiddleware',
+	'django.contrib.messages.middleware.MessageMiddleware',
+	'django.middleware.clickjacking.XFrameOptionsMiddleware',
+)
+
+ROOT_URLCONF = 'kumquat_web.urls'
+WSGI_APPLICATION = 'kumquat_web.wsgi.application'
+
+TEMPLATE_DIRS = (os.path.join(BASE_DIR, 'templates'),)
+
+# Internationalization
+# https://docs.djangoproject.com/en/1.6/topics/i18n/
+LANGUAGE_CODE = 'en-us'
+TIME_ZONE = 'UTC'
+USE_I18N = True
+USE_L10N = True
+USE_TZ = True
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/1.6/howto/static-files/
+STATIC_URL = '/static/'
diff --git a/copy/var/zoneinit/includes/50-kumquat.sh b/copy/var/zoneinit/includes/50-kumquat.sh
index 6630540..e60905e 100644
--- a/copy/var/zoneinit/includes/50-kumquat.sh
+++ b/copy/var/zoneinit/includes/50-kumquat.sh
@@ -7,6 +7,7 @@ MYSQL_ROOT=$(mdata-get mysql_pw)
 MYSQL_KUMQUAT=${MYSQL_KUMQUAT:-$(mdata-get mysql_kumquat_pw 2>/dev/null)} || \
 MYSQL_KUMQUAT=$(od -An -N8 -x /dev/random | head -1 | tr -d ' ');
 mdata-put mysql_kumquat_pw "${MYSQL_KUMQUAT}"
+SECRET_KEY=$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-100})
 
 # check if database exists already
 if [ -d /var/mysql/kumquat ]; then
@@ -35,6 +36,9 @@ else
 fi
 
 cat >> /opt/kumquat/kumquat_web/settings.py <<EOF
+# Make this unique, and don't share it with anybody.
+SECRET_KEY = "${SECRET_KEY}"
+
 # Database
 # https://docs.djangoproject.com/en/1.6/ref/settings/#databases
 DATABASES = {
diff --git a/customize b/customize
index 15503b3..417b8d8 100755
--- a/customize
+++ b/customize
@@ -67,9 +67,13 @@ mkdir /opt/local/etc/httpd/ssl
 
 # Copy default index.html
 echo "* Copy default index.html"
-cp /tmp/default-index.html /opt/local/share/httpd/htdocs/
+cp /tmp/default-index.html /opt/local/share/httpd/htdocs/index.html
 rm /tmp/default-index.html
 
+# Copy default (basic) kumquat settings
+cp /tmp/kumquat-settings.py /opt/kumquat/kumquat_web/settings.py
+rm /tmp/kumquat-settings.py
+
 echo "* Cleaning up"
 rm -rf /root/*
 sm-prepare-image -y