diff --git a/gateway-api/dsh-demo/README.md b/gateway-api/dsh-demo/README.md
index deffd41..2519000 100644
--- a/gateway-api/dsh-demo/README.md
+++ b/gateway-api/dsh-demo/README.md
@@ -34,8 +34,9 @@ Browser ──▶ Gateway dsh-gateway (HTTPS, TLS-terminate)
    (replace `dsh-demo.example.com` with the actual public FQDN). Note the client
    ID and client secret.
 2. **oauth2-proxy Secret** — `kubectl -n dsh-demo create secret generic oauth2-proxy`
-   with `client-id`, `client-secret`, and a `cookie-secret`
-   (`openssl rand -base64 32`). See `oauth2-proxy-secret.yaml.example`.
+   with `client-id`, `client-secret`, and a `cookie-secret` (URL-safe, unpadded
+   base64 of 32 bytes: `python3 -c 'import secrets; print(secrets.token_urlsafe(32))'`).
+   See `oauth2-proxy-secret.yaml.example`.
 3. **TLS secret** — create `dsh-demo-tls` in `dsh-demo` (see `tls-secret.yaml.example`).
 4. **Gateway app env** — the `dsh-gateway` Deployment must run the SSO-capable
    image with `AUTH_PROXY_HEADER=X-Forwarded-User` and `COOKIE_SECURE=true`
diff --git a/gateway-api/dsh-demo/oauth2-proxy-secret.yaml.example b/gateway-api/dsh-demo/oauth2-proxy-secret.yaml.example
index bf73fb0..3fedc74 100644
--- a/gateway-api/dsh-demo/oauth2-proxy-secret.yaml.example
+++ b/gateway-api/dsh-demo/oauth2-proxy-secret.yaml.example
@@ -6,18 +6,27 @@
 #   kubectl -n dsh-demo create secret generic oauth2-proxy \
 #     --from-literal=client-id='<GitHub OAuth App client ID>' \
 #     --from-literal=client-secret='<GitHub OAuth App client secret>' \
-#     --from-literal=cookie-secret="$(openssl rand -base64 32)"
+#     --from-literal=cookie-secret="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
 #
-# The cookie secret must be a strong random value (16/24/32 bytes, base64).
-# Generate it with: openssl rand -base64 32
+# The cookie secret must decode (base64) to exactly 16, 24, or 32 bytes.
+# oauth2-proxy base64-decodes it, so it must be URL-safe, unpadded base64.
+# Generate it with either of:
+#
+#   python3 -c 'import secrets; print(secrets.token_urlsafe(32))'
+#   openssl rand -base64 32 | tr -- '+/' '-_' | tr -d '='
+#
+# Do NOT use plain `openssl rand -base64 32`: that yields 44 characters of
+# standard base64 (with "=" and possibly "+"/"/"), which oauth2-proxy cannot
+# decode and therefore treats as 44 raw bytes, failing with "cookie_secret must
+# be 16, 24, or 32 bytes ... but is 44 bytes".
 #
 # GitHub OAuth App (https://github.com/settings/developers):
 #   Homepage URL            https://dsh-demo.example.com
 #   Authorization callback  https://dsh-demo.example.com/oauth2/callback
 #   (replace dsh-demo.example.com with the actual public FQDN)
 #
-# NOTE: the cookie secret should NOT be base64-encoded again when passed via
-# --from-literal (kubectl stores it as-is and the Secret encodes it for you).
+# NOTE: pass the base64 value as-is via --from-literal (kubectl stores the
+# literal; it does not base64-encode it a second time).
 apiVersion: v1
 kind: Secret
 metadata:
@@ -27,4 +36,4 @@ type: Opaque
 stringData:
   client-id: "<github-oauth-app-client-id>"
   client-secret: "<github-oauth-app-client-secret>"
-  cookie-secret: "<openssl-rand-base64-32>"
+  cookie-secret: "<urlsafe-unpadded-base64-of-32-random-bytes>"