{ pkgs, config, ... }: {
  programs.zsh.enable = true;
  sops.secrets.root_password_hash = { };
  sops.secrets.root_password_hash.neededForUsers = true;

  users.users.root = {
    shell = pkgs.zsh;
    hashedPasswordFile = config.sops.secrets.root_password_hash.path;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwfb2jpKrBnCw28aevnH8HbE5YbcMXpdaVv2KmueDu6 torjus@gunter"
    ];
  };
}