diff --git a/Server/CLAUDE.md b/Server/CLAUDE.md
index 38648a70..577b2064 100644
--- a/Server/CLAUDE.md
+++ b/Server/CLAUDE.md
@@ -10,7 +10,9 @@ prometheus.
   `permissions/` role checks · `service/` domain logic shared by both entry points
 - `db/` hand-written query wrappers; `db/dbgen/` is generated (see `db-change`)
 - `cmd/` executable tooling, one `package main` per subdirectory —
-  `cmd/genprotocol/` regenerates the protocol constants from `protocol/schema.json`
+  `cmd/genprotocol/` regenerates the protocol constants from `protocol/schema.json`,
+  `cmd/seed/` fills a dev database (`go run ./cmd/seed -confirm-dev`).
+  `scripts/` holds shell/JS tooling only; no Go entry point lives there
 - `admin/` web admin panel · `updater/` self-update + signature verification ·
   `plugin/` WASM plugin runtime (`-tags wazero`) · `telemetry/` OTel (`-tags otel`)
 - `syncutil/` lock helpers that gain deadlock detection under `-tags deadlock`
diff --git a/Server/scripts/seed.go b/Server/cmd/seed/main.go
similarity index 93%
rename from Server/scripts/seed.go
rename to Server/cmd/seed/main.go
index a74651a0..e23dd6be 100644
--- a/Server/scripts/seed.go
+++ b/Server/cmd/seed/main.go
@@ -1,11 +1,13 @@
-// seed.go is a standalone tool that populates an OwnCord database with
-// development data (users, channels, messages, DMs). It is idempotent:
-// running it multiple times against the same database is safe.
+// Command seed populates an OwnCord database with development data (users,
+// channels, messages, DMs). It is idempotent: running it multiple times
+// against the same database is safe.
 //
-// Usage:
+// Usage (from the Server/ directory):
 //
-//	go run scripts/seed.go                         # uses ./data/chatserver.db
-//	go run scripts/seed.go -db path/to/owncord.db  # custom path
+//	go run ./cmd/seed -confirm-dev                        # uses ./data/chatserver.db
+//	go run ./cmd/seed -confirm-dev -db path/to/owncord.db # custom path
+//
+// -confirm-dev is mandatory: the seeded accounts use weak passwords.
 package main
 
 import (
@@ -137,6 +139,15 @@ func main() {
 
 	log.SetFlags(0) // no timestamp prefix — keep output clean
 
+	// The default DB path is data/chatserver.db, and db.Open does not create
+	// intermediate directories. Ensure ./data exists so a fresh checkout works.
+	// This sits here rather than in an init() so that importing or building the
+	// package touches no filesystem — the tool creates the directory only when
+	// it is actually about to open the default database.
+	if err := os.MkdirAll("data", 0o750); err != nil {
+		log.Printf("warning: could not create data directory: %v", err)
+	}
+
 	database, err := db.Open(*dbPath)
 	if err != nil {
 		log.Fatalf("failed to open database at %s: %v", *dbPath, err)
@@ -359,13 +370,3 @@ func createDMConversation(database *db.DB, userIDs []int64) (int, error) {
 
 	return created, nil
 }
-
-// ─── Ensure data directory exists ───────────────────────────────────────────
-
-func init() {
-	// The default DB path is data/chatserver.db. Ensure the data directory
-	// exists so db.Open doesn't fail on a fresh checkout.
-	if err := os.MkdirAll("data", 0o750); err != nil {
-		log.Printf("warning: could not create data directory: %v", err)
-	}
-}