diff --git a/common/users/default.nix b/common/users/default.nix
index 620c824..9e58dba 100644
--- a/common/users/default.nix
+++ b/common/users/default.nix
@@ -4,4 +4,6 @@
     ./randomcat.nix
     ./richard.nix
   ];
-}
\ No newline at end of file
+
+  users.mutableUsers = false;
+}
diff --git a/hosts/tohru/configuration.nix b/hosts/tohru/configuration.nix
index ff3a1a5..f248b63 100644
--- a/hosts/tohru/configuration.nix
+++ b/hosts/tohru/configuration.nix
@@ -43,6 +43,8 @@
   sound.enable = true;
   hardware.pulseaudio.enable = true;
 
+  age.secrets.user-password-tohru-qenya.file = ../../secrets/user-password-tohru-qenya.age;
+  users.users.qenya.hashedPasswordFile = config.age.secrets.user-password-tohru-qenya.path;
   users.users.qenya.extraGroups = [
     "wheel" # sudo
     "networkmanager" # UI wifi configuration
diff --git a/secrets.nix b/secrets.nix
index e6dd703..1eadd47 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -4,6 +4,7 @@ let
   commonKeys = keys.users.qenya;
 
   secrets = with keys; {
+    user-password-tohru-qenya = [ machines.tohru ];
     wireguard-peer-orm = [ machines.orm ];
     wireguard-peer-tohru = [ machines.tohru ];
     wireguard-peer-yevaud = [ machines.yevaud ];
diff --git a/secrets/user-password-tohru-qenya.age b/secrets/user-password-tohru-qenya.age
new file mode 100644
index 0000000..7075ed4
Binary files /dev/null and b/secrets/user-password-tohru-qenya.age differ