diff --git a/misc-tools/.gitignore b/misc-tools/.gitignore
index fec37855f2..bb48b82358 100644
--- a/misc-tools/.gitignore
+++ b/misc-tools/.gitignore
@@ -5,3 +5,4 @@
 /dj_make_chroot_docker
 /dj_run_chroot
 /dj_judgehost_cleanup
+/force-passwords
diff --git a/misc-tools/Makefile b/misc-tools/Makefile
index 883a324538..eaa0d6345a 100644
--- a/misc-tools/Makefile
+++ b/misc-tools/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/Makefile.global
 TARGETS =
 OBJECTS =
 
-SUBST_DOMSERVER = fix_permissions configure-domjudge import-contest
+SUBST_DOMSERVER = fix_permissions configure-domjudge import-contest force-passwords
 
 SUBST_JUDGEHOST = dj_make_chroot dj_run_chroot dj_make_chroot_docker \
                   dj_judgehost_cleanup
diff --git a/misc-tools/force-passwords.in b/misc-tools/force-passwords.in
new file mode 100755
index 0000000000..af7bf80092
--- /dev/null
+++ b/misc-tools/force-passwords.in
@@ -0,0 +1,22 @@
+#!/usr/bin/python3
+
+import subprocess
+
+webappdir = '@domserver_webappdir@'
+etcdir = '@domserver_etcdir@'
+
+with open(f'{etcdir}/restapi.secret', 'r') as f:
+    while True:
+        line = f.readline()
+        if line.startswith('#'):
+            continue
+        tokens = line.split()
+        if len(tokens) == 4 and tokens[0] == 'default':
+            user = tokens[2]
+            password = tokens[3]
+            subprocess.run([webappdir + '/bin/console', 'domjudge:reset-user-password', user, password])    
+        break
+
+with open(f'{etcdir}/initial_admin_password.secret', 'r') as f:
+    password = f.readline().strip()
+    subprocess.run([webappdir + '/bin/console', 'domjudge:reset-user-password', 'admin', password])