diff --git a/binderhub/app.py b/binderhub/app.py
index 4c9e8f4c2..5eb97aa9c 100644
--- a/binderhub/app.py
+++ b/binderhub/app.py
@@ -962,8 +962,7 @@ def initialize(self, *args, **kwargs):
                 "enable_api_only_mode": self.enable_api_only_mode,
             }
         )
-        if self.auth_enabled:
-            self.tornado_settings["cookie_secret"] = os.urandom(32)
+        self.tornado_settings["cookie_secret"] = os.urandom(32)
         if self.cors_allow_origin:
             self.tornado_settings.setdefault("headers", {})[
                 "Access-Control-Allow-Origin"