diff --git a/08.administration/default.md b/08.administration/default.md
index 7160f5d..bad56e7 100644
--- a/08.administration/default.md
+++ b/08.administration/default.md
@@ -18,17 +18,13 @@ The Dune admin panel is a browser-based interface for managing content, media, u
 
 ## Accessing the panel
 
-By default the panel is at `/admin`. Log in with the credentials created at first startup — Dune prints the password to the console and writes it to a temporary file:
+By default the panel is at `/admin`. Dune does not create a default admin account: create the first admin yourself (see below), then log in with it. A site that has no enabled admin logs a warning at startup with the command to run.
 
-```
-🔑 Default admin created — username: admin
-   Password written to: data/users/.admin-password-XXXXX
-   Read it, then delete the file and change your password.
-```
+> Before `@dune/plugin-admin` 3.3.0, first startup created a default `admin` account and wrote its password to a file. That no longer happens. Sites that already have an admin are unaffected.
 
-### Creating the first admin explicitly
+### Creating the first admin
 
-You don't have to rely on the generated password. Create the first admin yourself, either from the command line:
+Create the first admin from the command line:
 
 ```bash
 dune users:create admin@example.com --role admin --username admin --password-prompt
@@ -80,7 +76,7 @@ Three roles control what each user can do:
 
 Users are stored in `data/users/` (under `data_dir` in `system.yaml`) and should be committed to version control. Passwords are stored as PBKDF2 hashes — never in plaintext.
 
-On first startup, a default `admin` account is created automatically. Delete the temporary password file and change the password immediately.
+There is no default account; see [Creating the first admin](#creating-the-first-admin). To change a password later, use the admin panel or `dune users:passwd`.
 
 ## What the panel provides
 
diff --git a/16.for-developers/02.headless-mode/default.md b/16.for-developers/02.headless-mode/default.md
index a5ecc65..05a4544 100644
--- a/16.for-developers/02.headless-mode/default.md
+++ b/16.for-developers/02.headless-mode/default.md
@@ -257,7 +257,7 @@ For a more responsive dev loop, `bootstrap()` accepts a `dev: true` option that
 
 ## Admin panel
 
-The admin panel is available at `/admin` (or your configured `admin.path`) automatically via `mountDuneAdmin()`. On first run, a default admin account is created and the password written to `.dune/admin/admin-password.txt`. Read the file, then delete it and change the password in the admin UI.
+The admin panel is available at `/admin` (or your configured `admin.path`) automatically via `mountDuneAdmin()`. Dune creates no default admin, so create the first one before you log in: `dune users:create admin@example.com --role admin --password-prompt`, or set `DUNE_ADMIN_EMAIL` and `DUNE_ADMIN_PASSWORD` for the first boot. See [Creating the first admin](/docs/administration#creating-the-first-admin).
 
 The admin panel is fully functional in headless mode: create and edit pages, manage users, view metrics, configure plugins.