diff --git a/cmd/olliesrv/internal/toolclient/spawn.go b/cmd/olliesrv/internal/toolclient/spawn.go
index 050286b..496bc03 100644
--- a/cmd/olliesrv/internal/toolclient/spawn.go
+++ b/cmd/olliesrv/internal/toolclient/spawn.go
@@ -64,8 +64,15 @@ func Spawn(ctx context.Context, cwd string, opts ...Option) (*Process, error) {
 	}
 
 	// Generate socket path and secret
-	socketPath := filepath.Join(os.TempDir(), fmt.Sprintf("toolsrv-%d-%s.sock", os.Getpid(), randomHex(8)))
-	secret := randomHex(32)
+	socketID, err := randomHex(8)
+	if err != nil {
+		return nil, fmt.Errorf("generate socket path: %w", err)
+	}
+	socketPath := filepath.Join(os.TempDir(), fmt.Sprintf("toolsrv-%d-%s.sock", os.Getpid(), socketID))
+	secret, err := randomHex(32)
+	if err != nil {
+		return nil, fmt.Errorf("generate toolsrv secret: %w", err)
+	}
 
 	// Find toolsrv binary
 	toolsrvPath, err := findToolsrv()
@@ -174,8 +181,16 @@ func SpawnRemote(ctx context.Context, cfg RemoteConfig) (*Process, error) {
 	if err := os.MkdirAll(sockDir, 0700); err != nil {
 		return nil, fmt.Errorf("create socket directory: %w", err)
 	}
-	localSock := filepath.Join(sockDir, fmt.Sprintf("remote-%d-%s.sock", os.Getpid(), randomHex(8)))
-	remoteSock := fmt.Sprintf("/tmp/ollie-toolsrv-%d-%s.sock", os.Getpid(), randomHex(8))
+	localID, err := randomHex(8)
+	if err != nil {
+		return nil, fmt.Errorf("generate local socket path: %w", err)
+	}
+	remoteID, err := randomHex(8)
+	if err != nil {
+		return nil, fmt.Errorf("generate remote socket path: %w", err)
+	}
+	localSock := filepath.Join(sockDir, fmt.Sprintf("remote-%d-%s.sock", os.Getpid(), localID))
+	remoteSock := fmt.Sprintf("/tmp/ollie-toolsrv-%d-%s.sock", os.Getpid(), remoteID)
 
 	// Build remote bootstrap script
 	// Extracts tarball to ~/.cache/ollie, sets XDG_CONFIG_HOME so tools/*.meta are found
@@ -447,10 +462,12 @@ func (pk *ProcessKeeper) Close() error {
 
 // --- Helpers ---
 
-func randomHex(n int) string {
+func randomHex(n int) (string, error) {
 	b := make([]byte, n)
-	rand.Read(b)
-	return hex.EncodeToString(b)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
 }
 
 func findToolsrv() (string, error) {
diff --git a/cmd/olliesrv/internal/toolclient/toolsrv.go b/cmd/olliesrv/internal/toolclient/toolsrv.go
index 5a3d0b4..c36b9b9 100644
--- a/cmd/olliesrv/internal/toolclient/toolsrv.go
+++ b/cmd/olliesrv/internal/toolclient/toolsrv.go
@@ -43,7 +43,11 @@ func DialToolsrv(socketPath string, secret string) (*ToolsrvConn, error) {
 
 	// Generate secret if not provided
 	if secret == "" {
-		secret = randomSecret()
+		secret, err = randomSecret()
+		if err != nil {
+			conn.Close()
+			return nil, fmt.Errorf("generate secret: %w", err)
+		}
 	}
 
 	// Authenticate via Tauth
@@ -498,10 +502,12 @@ func (e RateLimitedError) Error() string {
 
 // --- Helpers ---
 
-func randomSecret() string {
+func randomSecret() (string, error) {
 	b := make([]byte, 16)
-	rand.Read(b)
-	return hex.EncodeToString(b)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
 }
 
 func splitLines(s string) []string {
diff --git a/cmd/toolsrv/internal/server/server.go b/cmd/toolsrv/internal/server/server.go
index a54e4dc..b8e3d02 100644
--- a/cmd/toolsrv/internal/server/server.go
+++ b/cmd/toolsrv/internal/server/server.go
@@ -62,8 +62,12 @@ func (s *Server) Authenticate(clientSecret string) (string, error) {
 	defer s.mu.Unlock()
 
 	if s.secret == "" {
+		token, err := randomToken()
+		if err != nil {
+			return "", fmt.Errorf("generate authentication token: %w", err)
+		}
 		s.secret = clientSecret
-		s.token = randomToken()
+		s.token = token
 		return s.token, nil
 	}
 
@@ -100,10 +104,12 @@ func GenerateSecret() (string, error) {
 	return hex.EncodeToString(secret), nil
 }
 
-func randomToken() string {
+func randomToken() (string, error) {
 	b := make([]byte, 16)
-	rand.Read(b)
-	return hex.EncodeToString(b)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
 }
 
 // Spec returns the virtfs specification for the toolsrv namespace.