diff --git a/config/users/kat/nixos.nix b/config/users/kat/nixos.nix
index f91a60eb..97a1660b 100644
--- a/config/users/kat/nixos.nix
+++ b/config/users/kat/nixos.nix
@@ -9,8 +9,7 @@
     ];
     shell = pkgs.zsh;
     extraGroups = [ "wheel" "video" "systemd-journal" "plugdev" "bird2" "vfio" "input" "uinput" ];
-    hashedPassword =
-      removeSuffix "\n" config.kw.secrets.repo.kat-user.text;
+    hashedPassword = mkIf (config.deploy.profile.trusted) removeSuffix "\n" config.kw.secrets.repo.kat-user.text;
   };
 
   systemd.tmpfiles.rules = [