diff --git a/iso/common.nix b/iso/common.nix
index 3c37e88..ef7077f 100644
--- a/iso/common.nix
+++ b/iso/common.nix
@@ -77,7 +77,8 @@ in
       PermitRootLogin = "yes";
     };
   };
-  users.users.root.initialPassword = "sovran-remote";
+  users.users.root.initialPassword = lib.mkForce "sovran-remote";
+  users.users.root.initialHashedPassword = lib.mkForce null;
 
   # mDNS so the machine is discoverable as sovran-installer.local
   services.avahi = {