diff --git a/app/Controllers/Setup.php b/app/Controllers/Setup.php
index e37a1c2..4c5c3a8 100644
--- a/app/Controllers/Setup.php
+++ b/app/Controllers/Setup.php
@@ -22,6 +22,14 @@ class Setup extends BaseController
             return $this->response->setStatusCode(404)->setBody('Setup is already completed and locked.');
         }
 
+        $keyFromEnv = trim((string) env('setup.dbToolsKey', ''));
+        if ($keyFromEnv !== '') {
+            $keyFromRequest = trim((string) ($this->request->getGet('key') ?? $this->request->getPost('key') ?? ''));
+            if ($keyFromRequest !== '' && hash_equals($keyFromEnv, $keyFromRequest)) {
+                return null;
+            }
+        }
+
         if (!function_exists('auth')) {
             return null;
         }
@@ -77,6 +85,7 @@ class Setup extends BaseController
             'tables' => $tableRows,
             'msg' => $flash,
             'lock_file' => $this->lockFilePath(),
+            'setup_key' => trim((string) env('setup.dbToolsKey', '')),
         ]);
     }
 
diff --git a/app/Views/setup/db_setup.php b/app/Views/setup/db_setup.php
index 5f162a4..3aac895 100644
--- a/app/Views/setup/db_setup.php
+++ b/app/Views/setup/db_setup.php
@@ -19,6 +19,9 @@
 
             <form method="post" action="<?= base_url('setup/db-tools/generate') ?>">
                 <?= csrf_field() ?>
+                <?php if (!empty($setup_key ?? '')) : ?>
+                    <input type="hidden" name="key" value="<?= esc($setup_key) ?>">
+                <?php endif; ?>
                 <div class="table-responsive" style="max-height:520px; overflow:auto; border:1px solid #eee;">
                     <table class="table table-striped table-bordered">
                         <thead>
@@ -64,6 +67,9 @@
 
             <form method="post" action="<?= base_url('setup/db-tools/complete') ?>" onsubmit="return confirm('This will lock setup page. Continue?');">
                 <?= csrf_field() ?>
+                <?php if (!empty($setup_key ?? '')) : ?>
+                    <input type="hidden" name="key" value="<?= esc($setup_key) ?>">
+                <?php endif; ?>
                 <button type="submit" class="btn btn-danger">Complete Setup and Lock Page</button>
                 <p class="text-muted" style="margin-top:8px;">Lock file: <?= esc($lock_file ?? '') ?></p>
             </form>