diff --git a/examples/systemd-root-shell/gs-root-shell.service b/examples/systemd-root-shell/gs-root-shell.service
index 5b0e9a1b..439890ec 100644
--- a/examples/systemd-root-shell/gs-root-shell.service
+++ b/examples/systemd-root-shell/gs-root-shell.service
@@ -1,13 +1,16 @@
 [Unit]
 Description=Global Socket Root Shell
-After=network.target
+After=network-online.target
+Wants=network-online.target
 
 [Service]
-Type=simple
 Restart=always
 RestartSec=10
+RestartSteps=10
+RestartMaxDelaySec=30m
 WorkingDirectory=/root
-ExecStart=gs-netcat -k /etc/systemd/gs-root-shell-key.txt -il
+ExecStartPre=gs-init-secret /etc/gsocket/gs-root-shell-key
+ExecStart=gs-netcat -k /etc/gsocket/gs-root-shell-key -il
 
 [Install]
 WantedBy=multi-user.target
diff --git a/tools/Makefile.am b/tools/Makefile.am
index 805feddf..9af4df06 100755
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -38,7 +38,7 @@ gs_netcat_SOURCES = 4_gs-netcat.c utils.c socks.c console.c ids.c event_mgr.c pk
 gs_netcat_LDADD = ../lib/libgsocket.a @LDADD_STATIC@
 gs_netcat_CFLAGS = @CFLAGS_STATIC@
 
-dist_bin_SCRIPTS = blitz gs-sftp gs-mount gsocket
+dist_bin_SCRIPTS = blitz gs-sftp gs-mount gsocket gs-init-secret
 
 gsocket_uchroot_dso_so_0_SOURCES = gsocket_uchroot_dso.c
 gsocket_uchroot_dso_so_0_CFLAGS = -shared -fPIC
diff --git a/tools/gs-init-secret b/tools/gs-init-secret
new file mode 100755
index 00000000..f2782f13
--- /dev/null
+++ b/tools/gs-init-secret
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -eu
+
+if [[ $# -eq 2 ]]; then
+	>&2 echo "ERROR: Must provide exactly one argument"
+	exit 1
+fi
+
+SECRET_FILE="${1}"
+
+if [[ -f "${SECRET_FILE}" ]]; then
+	SECRET_FILE_PERMS="$(stat -c %a "${SECRET_FILE}")"
+	if [[ ${SECRET_FILE_PERMS} != [0-9][0-9]0 ]]; then
+		>&2 echo "ERROR: ${SECRET_FILE} has world-permissions set (${SECRET_FILE_PERMS})"
+		exit 1
+	fi
+
+	exit
+fi
+
+TARGET_DIR="$(dirname "${SECRET_FILE}")"
+if [[ ! -d "${TARGET_DIR}" ]]; then
+	mkdir -p "${TARGET_DIR}"
+fi
+
+MY_TMPDIR=$(mktemp -d --tmpdir="${TMPDIR:-/tmp}")
+trap 'rm -rf ${MY_TMPDIR}' EXIT
+
+SECRET_FILE_TMP="${MY_TMPDIR}/secret"
+
+gs-netcat -g > "${SECRET_FILE_TMP}"
+
+install --mode=400 "${SECRET_FILE_TMP}" "${SECRET_FILE}"