diff --git a/seed.py b/seed.py
new file mode 100644
index 0000000..4a9e9b3
--- /dev/null
+++ b/seed.py
@@ -0,0 +1,69 @@
+import os
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.core.passwords import hash_password
+from app.db import SessionLocal
+from app.models import OAuthClient, User
+
+ADMIN_EMAIL = os.getenv("SEED_ADMIN_EMAIL", "admin@example.com")
+ADMIN_PASSWORD = os.getenv("SEED_ADMIN_PASSWORD", "Kz8#Fj2!Lm9@Qw4$xR")
+DEMO_EMAIL = os.getenv("SEED_USER_EMAIL", "user@example.com")
+DEMO_PASSWORD = os.getenv("SEED_USER_PASSWORD", "DemoUser-Pass#2024")
+DEMO_CLIENT_ID = "demo-client"
+DEMO_CLIENT_URIS = ["https://example.com/callback"]
+
+
+def upsert_user(db: Session, email: str, password: str, is_admin: bool) -> User:
+    user = db.scalar(select(User).where(User.email == email))
+    if user is None:
+        user = User(email=email, hashed_password=hash_password(password))
+        db.add(user)
+    user.is_admin = is_admin
+    user.is_active = True
+    db.commit()
+    db.refresh(user)
+    return user
+
+
+def upsert_client(db: Session) -> OAuthClient:
+    client = db.scalar(
+        select(OAuthClient).where(OAuthClient.client_id == DEMO_CLIENT_ID)
+    )
+    if client is None:
+        client = OAuthClient(client_id=DEMO_CLIENT_ID, name="Demo App")
+        db.add(client)
+    client.name = "Demo App"
+    client.is_confidential = True
+    client.redirect_uris = DEMO_CLIENT_URIS
+    db.commit()
+    db.refresh(client)
+    return client
+
+
+def main() -> None:
+    db = SessionLocal()
+    try:
+        admin = upsert_user(db, ADMIN_EMAIL, ADMIN_PASSWORD, is_admin=True)
+        demo = upsert_user(db, DEMO_EMAIL, DEMO_PASSWORD, is_admin=False)
+        client = upsert_client(db)
+        summary = [
+            (admin.email, admin.id),
+            (demo.email, demo.id),
+            (client.client_id, client.name),
+        ]
+    finally:
+        db.close()
+
+    admin_email, admin_id = summary[0]
+    demo_email, demo_id = summary[1]
+    client_id, client_name = summary[2]
+    print("Seed complete:")
+    print(f"  admin   {admin_email} / {ADMIN_PASSWORD} (id={admin_id})")
+    print(f"  user    {demo_email} / {DEMO_PASSWORD} (id={demo_id})")
+    print(f"  client  {client_id} - {client_name}")
+
+
+if __name__ == "__main__":
+    main()