diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf78384..37f65bb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@
 
 - Named hooks (`[[hook]]`) referenced by certificates via `hooks = ["name"]`. Triggered hooks run after all renewals complete, in definition order.
 - Multiple listen addresses for HTTP-01 and TLS-ALPN-01 solvers (`listen = ["[::]:80", "[::]:8080"]`). Certforge tries all addresses and succeeds if at least one binds. Useful for initial provisioning when a proxy isn't running yet.
+- `dane-check` now queries published TLSA records from DNS and verifies them against expected values. Exits with code 1 if any records are missing or mismatched.
 
 ### Fixes
 
@@ -14,10 +15,10 @@
 - Validate that every domain has a solver configured (via `solver`, `solvers`, or `default_solver`)
 - Warn about unused DNS clients, solvers, and hooks in config
 
-- `dane-check` now queries published TLSA records from DNS and verifies them against expected values. Exits with code 1 if any records are missing or mismatched.
-
 ### Changes
 
+- Remove `init` command (redundant with README documentation)
+
 ## 0.5.0 (2026-04-13)
 
 ### Features
diff --git a/README.md b/README.md
index 95f3f37..0ea7404 100644
--- a/README.md
+++ b/README.md
@@ -103,7 +103,6 @@ Commands:
   dane-publish  Force-(re)publish DANE TLSA records
   dane-check    Query and verify published TLSA records against current certs
   config-check  Validate configuration file
-  init          Print systemd-creds encrypt commands for initial setup
   account       Manage ACME account
 
 Options:
@@ -192,8 +191,6 @@ Every secret (ACME account key, TSIG keys, TLS private keys) supports two modes:
 - **`*_credential`** -- full path to a `systemd-creds` encrypted file. Certforge decrypts at runtime via `systemd-creds decrypt`. Services access the same file via `LoadCredentialEncrypted=` in their unit files.
 - **`*_path`** -- plain file on disk. Simpler setup, suitable for development or environments without TPM2.
 
-Run `certforge init` to generate the `systemd-creds encrypt` commands for your configuration.
-
 ### DANE
 
 Each certificate can have multiple `[[certificate.dane]]` blocks. A DANE block references a `[dns.*]` client for TLSA record publication:
@@ -254,7 +251,7 @@ The package ships with:
 systemctl enable --now certforge.timer
 ```
 
-For encrypted credentials, add `LoadCredentialEncrypted=` directives to service units that need access to TLS keys. Run `certforge init` to see the required directives.
+For encrypted credentials, add `LoadCredentialEncrypted=` directives to service units that need access to TLS keys. See the [Credential storage](#credential-storage) section for details.
 
 ## Known limitations
 
diff --git a/src/cli.rs b/src/cli.rs
index 0adbc73..cf28971 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -68,9 +68,6 @@ pub enum Command {
     /// Validate configuration file
     ConfigCheck,
 
-    /// Print systemd-creds encrypt commands for initial setup
-    Init,
-
     /// Manage ACME account
     Account {
         #[command(subcommand)]
diff --git a/src/main.rs b/src/main.rs
index ccb5e91..b4b32fc 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -78,11 +78,6 @@ async fn main() -> anyhow::Result<()> {
             }
         }
 
-        Command::Init => {
-            let config = config::Config::load(&cli.config)?;
-            print_init_commands(&config);
-        }
-
         Command::Account { action } => {
             let config = config::Config::load(&cli.config)?;
             match action {
@@ -258,41 +253,3 @@ async fn dane_check(
     Ok(())
 }
 
-fn print_init_commands(config: &config::Config) {
-    println!("# Run these commands to set up encrypted credentials.");
-    println!("# Pipe the secret data into each command via stdin.\n");
-
-    if let Some(path) = &config.acme.account_key_credential {
-        println!(
-            "# ACME account key (will be auto-generated if not present)\nsystemd-creds encrypt - {}\n",
-            path.display()
-        );
-    }
-
-    for (name, dns) in &config.dns {
-        if let Some(path) = &dns.tsig_key_credential {
-            println!(
-                "# DNS TSIG key for '{name}' (zones: {:?})\nsystemd-creds encrypt - {}\n",
-                dns.all_zones(),
-                path.display()
-            );
-        }
-    }
-
-    for cert in &config.certificates {
-        if let Some(path) = &cert.key_credential {
-            println!(
-                "# TLS private key for certificate '{}'\nsystemd-creds encrypt - {}\n",
-                cert.name,
-                path.display()
-            );
-        }
-    }
-
-    println!("# Example systemd unit LoadCredentialEncrypted directives:");
-    for cert in &config.certificates {
-        if let Some(path) = &cert.key_credential {
-            println!("# LoadCredentialEncrypted={}-tls-key:{}", cert.name, path.display());
-        }
-    }
-}