diff --git a/.github/workflows/template.yml b/.github/workflows/template.yml
index 2eef3ee..618bd69 100644
--- a/.github/workflows/template.yml
+++ b/.github/workflows/template.yml
@@ -78,10 +78,6 @@ jobs:
           # still in prerelease
           uv sync --prerelease=allow
 
-          scripts/get_web_port.sh
-
-          just resetdb
-
           just bootstrap
 
       - name: Set up Docker and docker buildx
diff --git a/convention-template/justfile b/convention-template/justfile
index 36cd49f..bd5a00a 100644
--- a/convention-template/justfile
+++ b/convention-template/justfile
@@ -14,6 +14,10 @@ bootstrap:
     scripts/get_local_docker_ports.sh
     scripts/get_web_port.sh
 
+    # if our .env isn't there, this is probably a checkout;
+    # we want to generate it instead.
+    scripts/ensure_env.sh
+
     # we run this again to get the new environment locked in
     docker compose up -d
 
diff --git a/convention-template/scripts/ensure_env.sh b/convention-template/scripts/ensure_env.sh
new file mode 100755
index 0000000..2577888
--- /dev/null
+++ b/convention-template/scripts/ensure_env.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+
+if test -f .env; then
+    echo ".env already exists; skipping"
+    exit 0
+fi
+
+SECRET_KEY=$(head -c 16 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9')
+DB_PASSWORD=$(head -c 16 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9')
+FLOWER_PASSWORD=$(head -c 16 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9')
+
+cat <<EOF >>.env
+# During development, you may not have OAuth; this allows usernames
+NOM_ALLOW_USERNAME_LOGIN=true
+
+NOM_DEBUG=True
+NOM_SECRET_KEY="$SECRET_KEY"
+NOM_DB_NAME=nominate
+NOM_DB_USER=postgres
+NOM_DB_PASSWORD="$DB_PASSWORD"
+NOM_DB_PORT=5432
+NOM_DB_HOST=localhost
+NOM_REDIS_HOST=localhost
+NOM_REDIS_PORT=6379
+NOM_ALLOWED_HOSTS=127.0.0.1,localhost
+
+NOM_OAUTH_KEY=bogon
+NOM_OAUTH_SECRET=bogon
+NOM_OAUTH_BACKEND=nom.oauth2_backends.DummyOAuth2Backend
+
+NOM_EMAIL_HOST=localhost
+NOM_EMAIL_PORT=51025
+
+CELERY_FLOWER_USER=flower
+CELERY_FLOWER_PASSWORD="$FLOWER_PASSWORD"
+EOF