diff --git a/src/node/cli.ts b/src/node/cli.ts
index 91260604d..088431b7a 100644
--- a/src/node/cli.ts
+++ b/src/node/cli.ts
@@ -505,17 +505,18 @@ export async function setDefaults(cliArgs: Args, configArgs?: ConfigArgs): Promi
 /**
  * Helper function to return the default config file.
  *
+ * @param {string} password - Password passed in (usually from generatePassword())
  * @returns The default config file:
  *
  * - bind-addr: 127.0.0.1:8080
  * - auth: password
- * - password: <generated-password>
+ * - password: <password>
  * - cert: false
  */
-export async function defaultConfigFile(): Promise<string> {
+export function defaultConfigFile(password: string): string {
   return `bind-addr: 127.0.0.1:8080
 auth: password
-password: ${await generatePassword()}
+password: ${password}
 cert: false
 `
 }
@@ -540,7 +541,8 @@ export async function readConfigFile(configPath?: string): Promise<ConfigArgs> {
   await fs.mkdir(path.dirname(configPath), { recursive: true })
 
   try {
-    await fs.writeFile(configPath, await defaultConfigFile(), {
+    const generatedPassword = await generatePassword()
+    await fs.writeFile(configPath, defaultConfigFile(generatedPassword), {
       flag: "wx", // wx means to fail if the path exists.
     })
     logger.info(`Wrote default config file to ${humanPath(configPath)}`)
diff --git a/test/unit/node/cli.test.ts b/test/unit/node/cli.test.ts
index 9bf9fbe67..97b648788 100644
--- a/test/unit/node/cli.test.ts
+++ b/test/unit/node/cli.test.ts
@@ -14,7 +14,7 @@ import {
   splitOnFirstEquals,
 } from "../../../src/node/cli"
 import { tmpdir } from "../../../src/node/constants"
-import { paths } from "../../../src/node/util"
+import { generatePassword, paths } from "../../../src/node/util"
 import { useEnv } from "../../utils/helpers"
 
 type Mutable<T> = {
@@ -645,16 +645,13 @@ describe("bindAddrFromArgs", () => {
 })
 
 describe("defaultConfigFile", () => {
-  it("should return the dfeault config file as a string", async () => {
-    const actualDefaultConfigFile = await defaultConfigFile()
-    // Since the password is autogenerated within the function
-    // we can't assert it with .toMatch
-    // but we can check that the config at least includes
-    // these strings.
-    const expectedStrings = [`bind-addr: 127.0.0.1:8080`, `auth: password`, `password`, `cert: false`]
+  it("should return the default config file as a string", async () => {
+    const password = await generatePassword()
+    const actual = defaultConfigFile(password)
 
-    expectedStrings.forEach((str) => {
-      expect(actualDefaultConfigFile).toContain(str)
-    })
+    expect(actual).toMatch(`bind-addr: 127.0.0.1:8080
+auth: password
+password: ${password}
+cert: false`)
   })
 })