diff --git a/cmd/keygen/main.go b/cmd/keygen/main.go
new file mode 100644
index 0000000..ec1ae03
--- /dev/null
+++ b/cmd/keygen/main.go
@@ -0,0 +1,17 @@
+package main
+
+import (
+	"fmt"
+	"log"
+
+	webpush "github.com/SherClockHolmes/webpush-go"
+)
+
+func main() {
+	priv, pub, err := webpush.GenerateVAPIDKeys()
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println("VAPID_PRIVATE_KEY=" + priv)
+	fmt.Println("VAPID_PUBLIC_KEY=" + pub)
+}
diff --git a/internal/push/handlers.go b/internal/push/handlers.go
index 8dff7f9..83cd9f7 100644
--- a/internal/push/handlers.go
+++ b/internal/push/handlers.go
@@ -2,9 +2,7 @@ package push
 
 import (
 	"context"
-	"crypto/rand"
 	"database/sql"
-	"encoding/base64"
 	"encoding/json"
 	"log/slog"
 	"net/http"
@@ -256,19 +254,4 @@ func (h *Handler) SendChannelNotification(ctx context.Context, channelID, author
 	}
 }
 
-// GenerateVAPIDKeys generates a new VAPID key pair.
-func GenerateVAPIDKeys() (publicKey, privateKey string, err error) {
-	privateKeyBytes := make([]byte, 32)
-	_, err = rand.Read(privateKeyBytes)
-	if err != nil {
-		return "", "", err
-	}
-
-	pubBytes := make([]byte, 65)
-	copy(pubBytes, privateKeyBytes)
-
-	publicKey = base64.RawURLEncoding.EncodeToString(pubBytes)
-	privateKey = base64.RawURLEncoding.EncodeToString(privateKeyBytes)
-
-	return publicKey, privateKey, nil
-}
+// GenerateVAPIDKeys is in cmd/keygen. Use github.com/SherClockHolmes/webpush-go directly.
diff --git a/keygen b/keygen
new file mode 100755
index 0000000..b5a9662
Binary files /dev/null and b/keygen differ