diff --git a/docker/keystone/start.sh b/docker/keystone/start.sh
index fb93609c9d..4dc0ffb7f4 100755
--- a/docker/keystone/start.sh
+++ b/docker/keystone/start.sh
@@ -1,12 +1,15 @@
 #!/bin/bash
 
-: ${KEYSTONE_DB_PASSWORD:=keystone}
 : ${KEYSTONE_ADMIN_PASSWORD:=redhat}
 
 if ! [ "$KEYSTONE_ADMIN_TOKEN" ]; then
 	KEYSTONE_ADMIN_TOKEN=$(openssl rand -hex 15)
 fi
 
+if ! [ "$KEYSTONE_DB_PASSWORD" ]; then
+	KEYSTONE_DB_PASSWORD=$(openssl rand -hex 15)
+fi
+
 mysql -h ${MARIADBMASTER_PORT_3306_TCP_ADDR} -u root -p${DB_ROOT_PASSWORD} mysql <<EOF
 CREATE DATABASE IF NOT EXISTS keystone;
 GRANT ALL PRIVILEGES ON keystone.* TO