diff --git a/hh/join.sh b/hh/join.sh
index 896914b..691b725 100755
--- a/hh/join.sh
+++ b/hh/join.sh
@@ -2,7 +2,30 @@
 # Join the live hack-house room.  Usage: ./join.sh <yourname> [host]
 #   local:  ./join.sh alice
 #   remote: ./join.sh alice 100.117.177.50
+# The room password (a shared secret) comes from $HH_PASSWORD, else a no-echo
+# prompt — never hardcoded, so it can't drift from the room's random password.
 NAME="${1:-guest}"
 HOST="${2:-127.0.0.1}"
 cd "$(dirname "$0")"
-exec ./target/debug/hack-house connect "$HOST" 4173 "$NAME" --password malware-bless --no-tls
+
+# Sync the latest code before joining, then rebuild so it takes effect. Pulls
+# are best-effort and fast-forward only: an unreachable remote or diverged
+# history just warns and is skipped — it never blocks you from joining.
+BRANCH="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"
+for remote in gitea origin; do
+  if git remote get-url "$remote" >/dev/null 2>&1; then
+    echo "⛧ syncing $BRANCH from $remote…"
+    git pull --ff-only "$remote" "$BRANCH" 2>&1 \
+      || echo "  (skipped — couldn't fast-forward from $remote/$BRANCH)"
+  fi
+done
+echo "⛧ building client…"
+cargo build --quiet 2>&1 || echo "✖ build failed — joining with the existing binary"
+
+PASSWORD="${HH_PASSWORD:-}"
+if [[ -z "$PASSWORD" ]]; then
+  read -rsp "⛧ room password: " PASSWORD < /dev/tty
+  echo
+fi
+[[ -n "$PASSWORD" ]] || { echo "✖ a password is required" >&2; exit 1; }
+exec ./target/debug/hack-house connect "$HOST" 4173 "$NAME" --password "$PASSWORD" --no-tls
diff --git a/hh/lets-hack.sh b/hh/lets-hack.sh
index 721c24e..74b6b65 100755
--- a/hh/lets-hack.sh
+++ b/hh/lets-hack.sh
@@ -53,7 +53,7 @@ environment (override any default):
   SESSION   tmux session name      (default: hh-test)
   HOST      server bind host       (default: 127.0.0.1)
   PORT      server port            (default: 4173)
-  PW        shared room password   (default: malware-bless)
+  PW        shared room password   (default: random, openssl-generated)
   THEME     theme name             (church | neon | crypt)
 
 examples:
@@ -79,7 +79,9 @@ DEMO_WT="${HH_DEMO_WORKTREE:-/tmp/hh-demo-$DEMO_BRANCH}"
 SESSION="${SESSION:-hh-test}"
 HOST="${HOST:-127.0.0.1}"
 PORT="${PORT:-4173}"
-PW="${PW:-malware-bless}"
+# Default room password: a fresh random secret per run (openssl), not a
+# well-known hardcoded one. Set PW=... to pin a chosen/reproducible password.
+PW="${PW:-$(openssl rand -hex 12)}"
 SRV_LOG="/tmp/hh-${SESSION}-server.log"
 SRV_PIDFILE="/tmp/hh-${SESSION}-server.pid"
 THEMES_DIR="$HERE/themes"
@@ -224,6 +226,7 @@ done
 tmux select-layout -t "$SESSION" tiled >/dev/null
 
 echo "clergy: ${USERS[*]}  ·  session: $SESSION  ·  $HOST:$PORT  ·  vestments: ${THEME:-church (default)}"
+echo "room password: $PW   (share with anyone joining; pin it with PW=... to reuse)"
 echo "tear down later with:  $0 --kill"
 
 # 4. land in the clergy. From a plain shell we replace this process with `attach`.