diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index 4b30eac4bdfb..9f458792c34b 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -876,13 +876,19 @@ in
 
             secret_key = mkOption {
               description = ''
-                Secret key used for signing. Please note that the contents of this option
+                Secret key used for signing data source settings like secrets and passwords.
+                Set this to a unique, random string in production, generated for example by running `openssl rand -hex 32`.
+
+                If you change this later you will need to update data source settings to re-encode them.
+
+                <https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#secret_key>
+
+                Please note that the contents of this option
                 will end up in a world-readable Nix store. Use the file provider
                 pointing at a reasonably secured file in the local filesystem
                 to work around that. Look at the documentation for details:
                 <https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider>
               '';
-              default = "SW2YcwTIb9zpOOhoPsMm";
               type = types.str;
             };
 
diff --git a/nixos/tests/grafana/basic.nix b/nixos/tests/grafana/basic.nix
index dbb211537447..27887bdb339c 100644
--- a/nixos/tests/grafana/basic.nix
+++ b/nixos/tests/grafana/basic.nix
@@ -18,6 +18,7 @@ import ../make-test-python.nix (
           security = {
             admin_user = "testadmin";
             admin_password = "snakeoilpwd";
+            secret_key = "11111111111111111111";
           };
         };
       };
diff --git a/nixos/tests/grafana/provision/default.nix b/nixos/tests/grafana/provision/default.nix
index d4a1e29ed7c2..550b2c4189e0 100644
--- a/nixos/tests/grafana/provision/default.nix
+++ b/nixos/tests/grafana/provision/default.nix
@@ -19,6 +19,7 @@ import ../../make-test-python.nix (
           security = {
             admin_user = "testadmin";
             admin_password = "$__file{${pkgs.writeText "pwd" "snakeoilpwd"}}";
+            secret_key = "11111111111111111111";
           };
         };
       };