diff --git a/.env.example b/.env.example
index ddac900..ccd3166 100644
--- a/.env.example
+++ b/.env.example
@@ -19,3 +19,6 @@ DATA_DIR=/home/timetracker/app/data
 
 # CSRF trusted origins
 CSRF_TRUSTED_ORIGINS=https://tracker.kucharczyk.xyz
+
+# Create a default admin/admin superuser on startup (for initial setup only)
+CREATE_DEFAULT_SUPERUSER=false
diff --git a/docker-compose.yml b/docker-compose.yml
index 3ca2704..bf710ff 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,6 +12,7 @@ services:
       - PUID=${PUID:-1000}
       - PGID=${PGID:-100}
       - DATA_DIR=${DATA_DIR:-/home/timetracker/app/data}
+      - CREATE_DEFAULT_SUPERUSER=${CREATE_DEFAULT_SUPERUSER:-false}
     ports:
       - "${TIMETRACKER_EXTERNAL_PORT:-8000}:8000"
     volumes:
diff --git a/entrypoint.sh b/entrypoint.sh
index 2c3946d..4ef7de8 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -20,4 +20,16 @@ chown "$PUID:$PGID" /var/log/supervisor
 python manage.py migrate
 python manage.py collectstatic --clear --no-input
 
+if [ "${CREATE_DEFAULT_SUPERUSER:-false}" = "true" ]; then
+    python manage.py shell -c "
+from django.contrib.auth import get_user_model
+User = get_user_model()
+if not User.objects.filter(username='admin').exists():
+    User.objects.create_superuser('admin', '', 'admin')
+    print('Created default superuser: admin / admin')
+"
+fi
+
+chown -R "$PUID:$PGID" /home/timetracker/app/data
+
 exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisor.conf