diff --git a/node/icecast_config.go b/node/icecast_config.go
index dad85a3a82844a27b2bc2c01c021675d624f3cbf..c6546fe115b49632844e4d754a8cc3c56dba80b6 100644
--- a/node/icecast_config.go
+++ b/node/icecast_config.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/xml"
 	"io"
+	"io/ioutil"
 	"log"
 	"net"
 	"net/url"
@@ -16,8 +17,28 @@ import (
 var (
 	//shoutHttpPort = 8001
 	maxClients = 10000
+
+	icecastAdminPwFile = "/etc/icecast/.admin_pw"
+	icecastAdminPw     string
 )
 
+// Return the global Icecast admin password. If it does not exist,
+// generate a random one and save it for subsequent invocations.
+func getIcecastAdminPassword() string {
+	if icecastAdminPw == "" {
+		data, err := ioutil.ReadFile(icecastAdminPwFile)
+		if err != nil {
+			icecastAdminPw = autoradio.GeneratePassword()
+			if err := ioutil.WriteFile(icecastAdminPwFile, []byte(icecastAdminPw), 0600); err != nil {
+				log.Printf("Couldn't save icecast admin password: %v", err)
+			}
+		} else {
+			icecastAdminPw = string(data)
+		}
+	}
+	return icecastAdminPw
+}
+
 type iceLimitsConfig struct {
 	Clients int `xml:"clients"`
 	Sources int `xml:"sources"`
@@ -115,10 +136,12 @@ type icecastConfig struct {
 // that it is possible to set them on a per-host basis.
 //
 func defaultDebianConfig(publicIp string) *icecastConfig {
-	// Pick some random passwords on startup. We don't use them,
-	// but icecast is happier if they're set.
+	// Set the icecast admin password once, on the first run, and
+	// save it on the filesystem. We don't use the global source
+	// password, but icecast is happier if it's set, so we just
+	// use a random password every time.
 	sourcePw := autoradio.GeneratePassword()
-	adminPw := autoradio.GeneratePassword()
+	adminPw := getIcecastAdminPassword()
 
 	return &icecastConfig{
 		XMLName: xml.Name{"", "icecast"},