{ lib, ... }:
{
  flake.modules.nixos.sops-password =
    { config, ... }:
    {
      sops.secrets = lib.mapAttrs' (
        userName: _:
        lib.nameValuePair "hashed-password-${userName}" {
          neededForUsers = true;
        }
      ) config.meta.machine.users;

      users.users = lib.mapAttrs (userName: _: {
        hashedPasswordFile = config.sops.secrets."hashed-password-${userName}".path;
      }) config.meta.machine.users;
    };
}