diff --git a/setup.ps1 b/setup.ps1
index 04bf5a39..75a8011f 100644
--- a/setup.ps1
+++ b/setup.ps1
@@ -543,8 +543,20 @@ function Configure-TTS {
     }
 }
 
+# Generate INTERNAL_KEY for worker-to-backend auth if not already present
+function Ensure-InternalKey {
+    $content = if (Test-Path $ENV_FILE) { Get-Content $ENV_FILE -Raw } else { "" }
+    if ($content -notmatch "(?m)^INTERNAL_KEY=") {
+        $bytes = New-Object byte[] 32
+        [System.Security.Cryptography.RandomNumberGenerator]::Fill($bytes)
+        $internal_key = ($bytes | ForEach-Object { $_.ToString("x2") }) -join ""
+        "INTERNAL_KEY=$internal_key" | Add-Content -Path $ENV_FILE -Encoding utf8
+    }
+}
+
 # Main advanced settings menu
 function Prompt-AdvancedSettings {
+    Ensure-InternalKey
     Write-Host ""
     $configure_advanced = Read-Host "Would you like to configure advanced settings? (y/N)"
     if ($configure_advanced -ne "y" -and $configure_advanced -ne "Y") {
diff --git a/setup.sh b/setup.sh
index a9c2688c..7ae1d3cc 100755
--- a/setup.sh
+++ b/setup.sh
@@ -396,8 +396,18 @@ configure_tts() {
     esac
 }
 
+# Generate INTERNAL_KEY for worker-to-backend auth if not already present
+ensure_internal_key() {
+    if ! grep -q "^INTERNAL_KEY=" "$ENV_FILE" 2>/dev/null; then
+        local internal_key
+        internal_key=$(openssl rand -hex 32 2>/dev/null || head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n')
+        echo "INTERNAL_KEY=$internal_key" >> "$ENV_FILE"
+    fi
+}
+
 # Main advanced settings menu
 prompt_advanced_settings() {
+    ensure_internal_key
     echo
     read -p "$(echo -e "${DEFAULT_FG}Would you like to configure advanced settings? (y/N): ${NC}")" configure_advanced
     if [[ ! "$configure_advanced" =~ ^[yY]$ ]]; then