diff --git a/.gitignore b/.gitignore
index 2d8a42772c..f083d9eb20 100644
--- a/.gitignore
+++ b/.gitignore
@@ -80,3 +80,5 @@ test-results/
 playwright-report/
 blob-report/
 cloud/
+omnirouteCloud/
+omnirouteSite/
diff --git a/src/app/api/settings/route.js b/src/app/api/settings/route.js
index 13aff77650..9e427f1639 100644
--- a/src/app/api/settings/route.js
+++ b/src/app/api/settings/route.js
@@ -13,7 +13,7 @@ export async function GET() {
     return NextResponse.json({
       ...safeSettings,
       enableRequestLogs,
-      hasPassword: !!password,
+      hasPassword: !!password || !!process.env.INITIAL_PASSWORD,
     });
   } catch (error) {
     console.log("Error getting settings:", error);
diff --git a/src/app/login/page.js b/src/app/login/page.js
index f114147c7a..104161f32f 100644
--- a/src/app/login/page.js
+++ b/src/app/login/page.js
@@ -108,9 +108,11 @@ export default function LoginPage() {
               Login
             </Button>
 
-            <p className="text-xs text-center text-text-muted mt-2">
-              Default password is <code className="bg-sidebar px-1 rounded">123456</code>
-            </p>
+            {!hasPassword && (
+              <p className="text-xs text-center text-text-muted mt-2">
+                Default password is <code className="bg-sidebar px-1 rounded">123456</code>
+              </p>
+            )}
 
             <p className="text-xs text-center mt-1">
               <a href="/forgot-password" className="text-primary hover:underline">
diff --git a/src/lib/db/settings.js b/src/lib/db/settings.js
index 53c48ee0b6..1dea219436 100644
--- a/src/lib/db/settings.js
+++ b/src/lib/db/settings.js
@@ -15,6 +15,20 @@ export async function getSettings() {
   for (const row of rows) {
     settings[row.key] = JSON.parse(row.value);
   }
+
+  // Auto-complete onboarding for pre-configured deployments (Docker/VM)
+  // If INITIAL_PASSWORD is set via env, this is a headless deploy — skip the wizard
+  if (!settings.setupComplete && process.env.INITIAL_PASSWORD) {
+    settings.setupComplete = true;
+    settings.requireLogin = true;
+    db.prepare(
+      "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('settings', 'setupComplete', 'true')"
+    ).run();
+    db.prepare(
+      "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('settings', 'requireLogin', 'true')"
+    ).run();
+  }
+
   return settings;
 }
 
diff --git a/src/proxy.js b/src/proxy.js
index 6140c1e428..a0895a5649 100644
--- a/src/proxy.js
+++ b/src/proxy.js
@@ -49,9 +49,9 @@ export async function proxy(request) {
       if (settings.requireLogin === false) {
         return response;
       }
-      // Skip auth if no password has been set yet (fresh install)
+      // Skip auth if no password has been set yet (fresh install with no env override)
       // This prevents an unresolvable loop where requireLogin=true but no password exists
-      if (!settings.password) {
+      if (!settings.password && !process.env.INITIAL_PASSWORD) {
         return response;
       }
     } catch (err) {