diff --git a/backend/app/core/security.py b/backend/app/core/security.py
index 5f5294c..877c52a 100644
--- a/backend/app/core/security.py
+++ b/backend/app/core/security.py
@@ -1,11 +1,17 @@
+import base64
+import hashlib
 from cryptography.fernet import Fernet
 from app.core.config import get_settings
 
 
+def _derive_fernet_key(secret: str) -> bytes:
+    digest = hashlib.sha256(secret.encode("utf-8")).digest()
+    return base64.urlsafe_b64encode(digest)
+
+
 def _get_fernet() -> Fernet:
     settings = get_settings()
-    key = settings.SECRET_KEY.encode("utf-8")
-    key = key.ljust(44, b"=")[:44]
+    key = _derive_fernet_key(settings.SECRET_KEY)
     return Fernet(key)