diff --git a/modules/helfi_user_roles/helfi_user_roles.install b/modules/helfi_user_roles/helfi_user_roles.install
index b0c80a0e3..ef7f5e5ad 100644
--- a/modules/helfi_user_roles/helfi_user_roles.install
+++ b/modules/helfi_user_roles/helfi_user_roles.install
@@ -8,6 +8,7 @@
 declare(strict_types = 1);
 
 use Drupal\user\Entity\Role;
+use Drupal\user\Entity\User;
 
 /**
  * Grants required permissions.
@@ -71,3 +72,30 @@ function helfi_user_roles_update_9001() : void {
   ])
     ->save();
 }
+
+/**
+ * Randomize password for uid 1 user.
+ */
+function helfi_user_roles_update_9002() : void {
+  try {
+    // Attempt to resolve active environment. If this throws an exception, this
+    // is not running in the main instances, and we don't want to change the
+    // password.
+    \Drupal::service('helfi_api_base.environment_resolver')->getActiveEnvironment();
+  }
+  catch (\InvalidArgumentException) {
+    return;
+  }
+
+  $user = User::load(1);
+  if (empty($user)) {
+    return;
+  }
+
+  // Random password, 192 bits of entropy.
+  $password = base64_encode(random_bytes(24));
+
+  $user
+    ->setPassword($password)
+    ->save();
+}