diff --git a/common/pam_u2f.nix b/common/pam_u2f.nix
index df27728..89066f7 100644
--- a/common/pam_u2f.nix
+++ b/common/pam_u2f.nix
@@ -9,4 +9,7 @@
     appId = "pam://bureautix-exemple";
     origin = "pam://bureautix-exemple";
   };
+
+  # Accounts authenticate with their FIDO2 key, none of them has a password.
+  users.allowNoPasswordLogin = true;
 }
diff --git a/common/superadmins.nix b/common/superadmins.nix
index 99f30c4..450770d 100644
--- a/common/superadmins.nix
+++ b/common/superadmins.nix
@@ -8,6 +8,6 @@
     keys = [ ];
   };
 
-  # password is `nixos`
-  users.users.root.hashedPassword = "$y$j9T$1aoCSeVE6c0STJ0MLSVjK/$jNxZFMVj..HMf5/l14b6I4VufioAr/cNp29ea1S4C4D";
+  # root has no password, remote access goes through the SSH keys above.
+  users.users.root.hashedPassword = "!";
 }
diff --git a/inventory/users/abelard.nix b/inventory/users/abelard.nix
index b2ecb14..8a7566c 100644
--- a/inventory/users/abelard.nix
+++ b/inventory/users/abelard.nix
@@ -7,8 +7,8 @@
   securix.self.user = {
     email = "abelard@example.com";
     username = "abelard";
-    # password is `test`
-    hashedPassword = "$y$j9T$zk4xGLyshz7RzqnMX6M8O0$AybRelILMkQSWcQZV4s.ykRNi/UlgaCUaDwdee0n7N2";
+    # Generated with pamu2fcfg --appid pam://bureautix-exemple --origin pam://bureautix-exemple --nouser
+    u2f_keys = [ ];
     defaultLoginShell = pkgs.zsh;
   };
 }
diff --git a/inventory/users/alice.nix b/inventory/users/alice.nix
index 36c8fac..10e2016 100644
--- a/inventory/users/alice.nix
+++ b/inventory/users/alice.nix
@@ -7,8 +7,8 @@
   securix.self.user = {
     email = "alice@example.com";
     username = "alice";
-    # password is `test`
-    hashedPassword = "$y$j9T$zk4xGLyshz7RzqnMX6M8O0$AybRelILMkQSWcQZV4s.ykRNi/UlgaCUaDwdee0n7N2";
+    # Generated with pamu2fcfg --appid pam://bureautix-exemple --origin pam://bureautix-exemple --nouser
+    u2f_keys = [ ];
     defaultLoginShell = pkgs.zsh;
   };
 }
diff --git a/inventory/users/bob.nix b/inventory/users/bob.nix
index 865dbc8..b60e847 100644
--- a/inventory/users/bob.nix
+++ b/inventory/users/bob.nix
@@ -7,8 +7,8 @@
   securix.self.user = {
     email = "bob@example.com";
     username = "bob";
-    # password is `test`
-    hashedPassword = "$y$j9T$zk4xGLyshz7RzqnMX6M8O0$AybRelILMkQSWcQZV4s.ykRNi/UlgaCUaDwdee0n7N2";
+    # Generated with pamu2fcfg --appid pam://bureautix-exemple --origin pam://bureautix-exemple --nouser
+    u2f_keys = [ ];
     defaultLoginShell = pkgs.zsh;
   };
 }
diff --git a/inventory/users/heloise.nix b/inventory/users/heloise.nix
index 39b3f36..8fd3e90 100644
--- a/inventory/users/heloise.nix
+++ b/inventory/users/heloise.nix
@@ -7,8 +7,8 @@
   securix.self.user = {
     email = "heloise@example.com";
     username = "heloise";
-    # password is `test`
-    hashedPassword = "$y$j9T$zk4xGLyshz7RzqnMX6M8O0$AybRelILMkQSWcQZV4s.ykRNi/UlgaCUaDwdee0n7N2";
+    # Generated with pamu2fcfg --appid pam://bureautix-exemple --origin pam://bureautix-exemple --nouser
+    u2f_keys = [ ];
     defaultLoginShell = pkgs.zsh;
   };
 }