diff --git a/justfile b/justfile
index fa4281c..09529b2 100644
--- a/justfile
+++ b/justfile
@@ -1,6 +1,9 @@
 default:
     @just --list
 
+seed secret="dev" name="":
+    bun src/seed.ts "{{secret}}" "{{name}}"
+
 dev:
     bun run dev
 
diff --git a/src/seed.ts b/src/seed.ts
new file mode 100644
index 0000000..6d3bd88
--- /dev/null
+++ b/src/seed.ts
@@ -0,0 +1,20 @@
+#!/usr/bin/env bun
+
+// Idempotent device seeding
+
+import { createDevice, getDeviceBySecret, initDb } from "./db";
+
+const args = process.argv.slice(2);
+const secret = args[0] || "dev";
+const name = args[1] || null;
+
+initDb();
+
+const existing = getDeviceBySecret(secret);
+if (existing) {
+	console.log(`device already exists: id=${existing.id} secret=${existing.secret} name=${existing.name}`);
+	process.exit(0);
+}
+
+const device = createDevice(secret, name);
+console.log(`created device: id=${device.id} secret=${device.secret} name=${device.name}`);