diff --git a/.gitignore b/.gitignore
index be4fabf..32ace86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
 /secrets/borg-backup-repo
 /secrets/miniflux-admin-credentials
 /secrets/matrix-registration-shared-secret
+/secrets/shadow-hashed-password-alarsyo
+/secrets/shadow-hashed-password-root
diff --git a/configuration.nix b/configuration.nix
index a9eca91..84d5af2 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -41,8 +41,12 @@
     "62.210.16.7"
   ];
 
-  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # Define a user account.
+  users.users.root = {
+    hashedPassword = lib.fileContents ./secrets/shadow-hashed-password-root;
+  };
   users.users.alarsyo = {
+    hashedPassword = lib.fileContents ./secrets/shadow-hashed-password-alarsyo;
     isNormalUser = true;
     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
     shell = pkgs.fish;
diff --git a/secrets/shadow-hashed-password-alarsyo.example b/secrets/shadow-hashed-password-alarsyo.example
new file mode 100644
index 0000000..4a66171
--- /dev/null
+++ b/secrets/shadow-hashed-password-alarsyo.example
@@ -0,0 +1 @@
+# Hashed password to generate with `mkpasswd -m sha-512`
diff --git a/secrets/shadow-hashed-password-root.example b/secrets/shadow-hashed-password-root.example
new file mode 100644
index 0000000..4a66171
--- /dev/null
+++ b/secrets/shadow-hashed-password-root.example
@@ -0,0 +1 @@
+# Hashed password to generate with `mkpasswd -m sha-512`