diff --git a/README.md b/README.md
index 39423cd8..ef45cc9a 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,17 @@ bundle exec rake db:seed
 
 #### Default Username/Password
 
-As part of running the above installation steps, you will be asked to set an admin email/password combination. The default values are `admin@example.com` and `test123`, respectively.
+The seed creates an admin user when no admin exists yet. Set the `ADMIN_EMAIL`
+and `ADMIN_PASSWORD` environment variables to choose its credentials:
+
+```shell
+ADMIN_EMAIL=you@example.com ADMIN_PASSWORD=... bundle exec rake spree_auth:admin:create
+```
+
+In the `development` and `test` environments, the credentials default to
+`admin@example.com` and `test123` when the variables are not set. In every other
+environment (`production`, `staging`, etc.) both variables are required, and the
+seed aborts with an error if either is missing.
 
 #### Confirmable
 
diff --git a/db/default/users.rb b/db/default/users.rb
index 0b40f0f4..e41f45ef 100644
--- a/db/default/users.rb
+++ b/db/default/users.rb
@@ -7,12 +7,24 @@
   return
 end
 
-email = ENV["ADMIN_EMAIL"] || "admin@example.com"
-password = ENV["ADMIN_PASSWORD"] || "test123"
+email = ENV["ADMIN_EMAIL"]
+password = ENV["ADMIN_PASSWORD"]
+
+if Rails.env.development? || Rails.env.test?
+  email ||= "admin@example.com"
+  password ||= "test123"
+elsif email.blank? || password.blank?
+  abort <<~MSG
+    Refusing to create an admin user with default credentials in the #{Rails.env} environment.
+    Set ADMIN_EMAIL and ADMIN_PASSWORD and run the task again, for example:
+
+      ADMIN_EMAIL=you@example.com ADMIN_PASSWORD=... bin/rails spree_auth:admin:create
+  MSG
+end
 
 puts "Creating admin user with:"
 puts "  - email: #{email}"
-puts "  - password: #{password}"
+puts "  - password: #{ENV["ADMIN_PASSWORD"] ? "(from ADMIN_PASSWORD)" : password}"
 puts "(please use the ADMIN_EMAIL and ADMIN_PASSWORD environment variables to control how the default admin user is created)"
 
 if Spree::User.find_by(email: email)
diff --git a/lib/generators/solidus/auth/install/install_generator.rb b/lib/generators/solidus/auth/install/install_generator.rb
index a3805aeb..ae4e4972 100644
--- a/lib/generators/solidus/auth/install/install_generator.rb
+++ b/lib/generators/solidus/auth/install/install_generator.rb
@@ -18,14 +18,7 @@ def generate_devise_key
         end
 
         def add_migrations
-          admin_email = options[:admin_email] || (options[:interactive] && ask("Email:", default: "admin@example.com"))
-          admin_password = options[:admin_password] || (options[:interactive] && ask("Password:", default: "test123"))
-
-          options = []
-          options << "ADMIN_EMAIL=#{admin_email}" if admin_email
-          options << "ADMIN_PASSWORD=#{admin_password}" if admin_password
-
-          rake "railties:install:migrations FROM=solidus_auth #{options.shelljoin}"
+          rake "railties:install:migrations FROM=solidus_auth"
         end
 
         def run_migrations
@@ -33,11 +26,26 @@ def run_migrations
               options[:auto_run_migrations] == false || # exclude nil
               options[:interactive] && no?("Would you like to run the migrations now?")
 
+            @migrations_skipped = true
             say_status :skip, "Skipping rake db:migrate, don't forget to run it!", :yellow
           else
             rake "db:migrate"
           end
         end
+
+        def create_admin_user
+          return if @migrations_skipped
+
+          admin_email = options[:admin_email] || (options[:interactive] && ask("Email:", default: "admin@example.com"))
+          admin_password = options[:admin_password] || (options[:interactive] && ask("Password:", default: "test123"))
+          return unless admin_email || admin_password
+
+          env = []
+          env << "ADMIN_EMAIL=#{admin_email.shellescape}" if admin_email
+          env << "ADMIN_PASSWORD=#{admin_password.shellescape}" if admin_password
+
+          rake "spree_auth:admin:create #{env.join(" ")}"
+        end
       end
     end
   end
diff --git a/spec/lib/generators/solidus/auth/install/install_generator_spec.rb b/spec/lib/generators/solidus/auth/install/install_generator_spec.rb
new file mode 100644
index 00000000..e1616daf
--- /dev/null
+++ b/spec/lib/generators/solidus/auth/install/install_generator_spec.rb
@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "rails/generators"
+require "generators/solidus/auth/install/install_generator"
+
+RSpec.describe Solidus::Auth::Generators::InstallGenerator do
+  let(:destination) { Dir.mktmpdir }
+  let(:rake_commands) { [] }
+
+  after { FileUtils.rm_rf(destination) }
+
+  def run_generator(*args)
+    generator = described_class.new([], args, destination_root: destination)
+    allow(generator).to receive(:rake) { |command| rake_commands << command }
+    generator.invoke_all
+  end
+
+  context "with admin credentials and migrations enabled" do
+    it "creates the admin user after migrating" do
+      run_generator("--auto-run-migrations", "--admin-email=owner@store.test", "--admin-password=s3cret-pass")
+
+      expect(rake_commands).to eq([
+        "railties:install:migrations FROM=solidus_auth",
+        "db:migrate",
+        "spree_auth:admin:create ADMIN_EMAIL=owner@store.test ADMIN_PASSWORD=s3cret-pass"
+      ])
+    end
+  end
+
+  context "with only an admin password" do
+    it "passes just that variable" do
+      run_generator("--auto-run-migrations", "--admin-password=s3cret-pass")
+
+      expect(rake_commands.last).to eq("spree_auth:admin:create ADMIN_PASSWORD=s3cret-pass")
+    end
+  end
+
+  context "without admin credentials" do
+    it "does not create an admin user" do
+      run_generator("--auto-run-migrations")
+
+      expect(rake_commands).to eq([
+        "railties:install:migrations FROM=solidus_auth",
+        "db:migrate"
+      ])
+    end
+  end
+
+  context "with admin credentials but skipped migrations" do
+    it "does not create an admin user" do
+      run_generator("--skip-migrations", "--admin-email=owner@store.test", "--admin-password=s3cret-pass")
+
+      expect(rake_commands).to eq(["railties:install:migrations FROM=solidus_auth"])
+    end
+  end
+end