diff --git a/config/servercmdline.txt b/config/servercmdline.txt
index 8c1655d7..248c0f0f 100644
--- a/config/servercmdline.txt
+++ b/config/servercmdline.txt
@@ -29,7 +29,7 @@
 // -Y     // 32-byte private server key (you should maybe include that from another config file and remove it from the server after startup)
 // -m     // masterserver URL (no parameter uses default URL), if not set, the server will be LAN-only
 
--Y AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA // this default value is a security risk so please define your own private server key (!!)
+// No private server key (-Y) set: the server runs LAN-only without any key or auth setup.
 
 // the switches o, n, n1 and n2 support coloring and character escaping; 'o' also supports escaped newlines
 // the available colors are: 0: green, 1: blue, 2: yellow, 3: red, 4: gray, 5: white, 6: dark brown, 7: dark red
diff --git a/server.sh b/server.sh
index 65f80ef5..8cf46ee3 100755
--- a/server.sh
+++ b/server.sh
@@ -57,6 +57,12 @@ if [ "$1" = "--outputbinarypath" ]; then
   echo "${BINARYPATH}"
   exit 0
 elif [ -x "${BINARYPATH}" ]; then
+  # Kill any leftover server instances from previous runs, so the ports are free.
+  # (anchored on "/<binary> " so we can never match our own command line)
+  if command -v pkill >/dev/null 2>&1; then
+    pkill -f "(^|/)$(basename "${BINARYPATH}")( |$)" >/dev/null 2>&1 || true
+    sleep 1
+  fi
   cd "${CUBE_DIR}"
   exec "${BINARYPATH}" ${CUBE_OPTIONS} ${CUBE_OPTIONFILE} "$@"
 else
diff --git a/source/src/protos.h b/source/src/protos.h
index fc71c52f..2da83608 100644
--- a/source/src/protos.h
+++ b/source/src/protos.h
@@ -1204,20 +1204,9 @@ struct servercommandline
         // client: dtwhzbsave
         switch(arg[1])
         { // todo: gjlqEJQU
-            case 'Y': // private server key
-            {
-                bool allas = true; // a is all A's?
-                loopi(strlen(a)){ if(a[i]!='A') allas = false; }
-                if(allas)
-                {
-                    printf("KEY FAILURE: you provided the (inacceptable) example private key.\nKEY FAILURE: generate your own - read: https://assault.cubers.net/docs/server.html\n");
-                }
-                else
-                {
-                    ssk = a;
-                }
-            }
-            break;
+            case 'Y': // private server key (optional, only needed to register with the masterserver)
+                ssk = a;
+                break;
             case '-':
                     if(!strncmp(arg, "--masterport=", 13))
                     {
diff --git a/source/src/serverms.cpp b/source/src/serverms.cpp
index 482944ac..bd911f96 100644
--- a/source/src/serverms.cpp
+++ b/source/src/serverms.cpp
@@ -364,7 +364,6 @@ void servermsinit(bool listen)
     if(!usemaster){
         mlog(ACLOG_INFO, "server is LAN-only - without connection to masterserver");
         if(listen){
-            if(!scl.ssk) mlog(ACLOG_INFO, "ACTION REQUIRED: you must provide a PRIVATE SERVER KEY via the '-Y' command line argument");
             if(!scl.master) mlog(ACLOG_INFO, "LAN-only because no master is given");
             if(scl.maxclients>MAXCLIENTSONMASTER) mlog(ACLOG_INFO, "LAN-only because too many clients for master");
         }