diff --git a/vars/per-machine/control/user-password-root/user-password-hash/groups/admins b/vars/per-machine/control/user-password-root/user-password-hash/groups/admins
new file mode 120000
index 0000000..6765aa1
--- /dev/null
+++ b/vars/per-machine/control/user-password-root/user-password-hash/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
\ No newline at end of file
diff --git a/vars/per-machine/control/user-password-root/user-password-hash/machines/control b/vars/per-machine/control/user-password-root/user-password-hash/machines/control
new file mode 120000
index 0000000..32ed094
--- /dev/null
+++ b/vars/per-machine/control/user-password-root/user-password-hash/machines/control
@@ -0,0 +1 @@
+../../../../../../sops/machines/control
\ No newline at end of file
diff --git a/vars/per-machine/control/user-password-root/user-password-hash/secret b/vars/per-machine/control/user-password-root/user-password-hash/secret
new file mode 100644
index 0000000..3009d12
--- /dev/null
+++ b/vars/per-machine/control/user-password-root/user-password-hash/secret
@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:r0i0hSQpZQfTP/2VhM7DkFAits86qDRlowbnwZqs4JrtvNjmReJe/mkF8xPT4eKusIzB/THAY4udgltrrOP0iFRMBPQqeFsd0w==,iv:+oYEln5OVeaFujy22IGKxKEgsExw0pSK3+bYQ82riPI=,tag:/FP5zwVfUszr3oAv6nwyVA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWSkthdHhQMHJ5THMxNUdS\nTGRZUVFDMEd6OVBPWFN3bXVzcFNnT0lrR1hrCkZ2bVRvVnJlM3BLc0ZqNUUwQ1VD\nMlJ1bmpkdzVYYURPOUorNkZKWDk5NGMKLS0tIC80Yy81K2owMDh6SFVMSmNOeERq\nVEJWNFRLV1gxOUx5WWJwWE5uNDR1eTgKdEcfmvFy5E81t2SWWEdPCbQy9nxGsMCT\nsZZxIbGwN0W3pf+QoPtIHl2tAixKy+gHPp8UNTGToDuK6ILSf8OoSQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1env5y2eey0p3dggs8tydwmtyhtwqylpg7spuququ4vvax6arzp2qjnm4tx"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTU8vOVRNbjBNOWpBWWpJ\nTUtIY1g4R1VVb2krNWxDOFpobkhuSmVkTFV3ClA0azFHVzkrY0xJdERZV0tLZkhN\nbldVYjJObjBIZm1RelB5VzBiU3dqK2sKLS0tIEdxRFRJMTI3RzI3ampRYVM2YWJI\nSU1pTWtRWVU2RDRHcmZtaGxhWElwd2sKK1zZtqqkdRMdITSKbJ/JilpAAflkgG5G\nnaeHwBIw75pZa6lQDM2aRWN+yFUMQtbJ3i7Zw/Du+emikyN1+hz5cg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBdzdqU0M0\nOGNqMHJLZ0V4RHhnclE2SUY0aVFVMjB1azVlUlE5VXBTbGRsTgpFWjNPaDErU0cy\nNFFGR0VIODRTamc0bWxCTFN4MU9CdllaWjhvOUJaeWU4Ci0tLSBlK09xeGpRenk0\nZjlLTkhtR0NZZ1Jna2xHbFpZeUl3aEZ4cndhcHFOQkk0CuX8TF7mW7GowFZ2X75v\ng8zrxp3xtMzPp/C+dbuu02Lfe9f/1jaBOTtJjR6BnV0ucfYjUhtw7OQ3qCUV7a+Z\nG0c=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
+			}
+		],
+		"lastmodified": "2026-07-28T10:15:43Z",
+		"mac": "ENC[AES256_GCM,data:uq8xDJBop1yPYMb6gNNWhKxJAiBdMjuYHhA3fvpCauDAakKgEGcSmc7/cnSAtds4NbsPkxi6tn32aJvF8QsKlSIycnqDpxGqpGVgYjvt/lasM50Ukwk6W+YGwTx8bnCmFazimJuaNg92G0VZAGI0uybITR3EEHws/9na69470jc=,iv:hJcVMW1Gaf9Rle5K3LJV/P9Eo7AVBss40rZ5csQml1o=,tag:5ql+BvXOYlgOgbNDl5o/vw==,type:str]",
+		"version": "3.13.1"
+	}
+}
diff --git a/vars/per-machine/control/user-password-root/user-password-hash/users/berwn b/vars/per-machine/control/user-password-root/user-password-hash/users/berwn
new file mode 120000
index 0000000..57d4221
--- /dev/null
+++ b/vars/per-machine/control/user-password-root/user-password-hash/users/berwn
@@ -0,0 +1 @@
+../../../../../../sops/users/berwn
\ No newline at end of file
diff --git a/vars/per-machine/control/user-password-root/user-password/groups/admins b/vars/per-machine/control/user-password-root/user-password/groups/admins
new file mode 120000
index 0000000..6765aa1
--- /dev/null
+++ b/vars/per-machine/control/user-password-root/user-password/groups/admins
@@ -0,0 +1 @@
+../../../../../../sops/groups/admins
\ No newline at end of file
diff --git a/vars/per-machine/control/user-password-root/user-password/secret b/vars/per-machine/control/user-password-root/user-password/secret
new file mode 100644
index 0000000..745c0f2
--- /dev/null
+++ b/vars/per-machine/control/user-password-root/user-password/secret
@@ -0,0 +1,18 @@
+{
+	"data": "ENC[AES256_GCM,data:TyTbzOZ9AOAaP5e96sleUEuuSq/FPjbfHZ6aeR5iOwvDtoc8ZhLYXEO+AF1p+DKS5hDA,iv:9VgMtKiHt8oYnNY8E9+bodU5ei3riw+Gx2KiOQBhoyk=,tag:zJXsCVITlqqrw72QqE/coQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdWJBOEkwM01BZDlMVS9W\nekFmT0JuMnZHNnBBOVhYK05Ra3VzMW9kK0ZrCkkzRk1JZHdzVlhBeEtTamNHb21x\nU1RkaDZYVEVFV1pyL0lSb1JXeWN6ZDgKLS0tIEVqWDZwZ1RBSS8rVVJLM1pSVkRY\nNEVub1diUytCUHZ1c3NPaWlCUHFYc2MK2lqzBTaw9qIFB6cucfxbMQGhLfSyHYhi\nRJf+pwI0BehAteT87IAbA63Sdx82QNb21mU1AYHPxLdDdrrHWnFxJA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBOUhYNXIz\nMU9VU3ZMN0NVT1JSZ2N0Q1hxS2dnZm5iY1Z2WUtsaWlXVks0MApxbEtmWWVmQlZ5\nNzZrLy85M1ZiSlc1Y01OM1VEYy9rZ2FhdU5uNTFPa3U0Ci0tLSBkM0ppSUJtMkVP\nWC9jN0NOam9iSy9xakNhOUN3NjBtVllvUU13Tlo4RUdNCtY/2d3ANDMh2Sx1aFlm\n/b3GKbXeeBeeHuFBAsQmuZXqb5EHGJsB9JpjsR0TJJVflCgYYSjn0L1xg9DG/ANa\nn1k=\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
+			}
+		],
+		"lastmodified": "2026-07-28T10:15:43Z",
+		"mac": "ENC[AES256_GCM,data:hVEI3iNwXa0O9ZkZWzb0OP8tnsTXWB0znLPg6FIx7Z7D9yPSwCpVu4qdtLwFnB6SEk1tnFykQofCKJ+UQtf6AuziGymwONUQWwUW7pF3zoKtxJ4bJQEKAVChgJqKx7GTp5HXxFkbrp03USJqaHqE9M0leRWIamdBeyXI9rdX9OE=,iv:dn4BqTra2ljHmXfoEoVFwRXXtwiLOs3j5fRNbvndIgA=,tag:zOaRMxl23pJRIvJo3ettEg==,type:str]",
+		"version": "3.13.1"
+	}
+}
diff --git a/vars/per-machine/control/user-password-root/user-password/users/berwn b/vars/per-machine/control/user-password-root/user-password/users/berwn
new file mode 120000
index 0000000..57d4221
--- /dev/null
+++ b/vars/per-machine/control/user-password-root/user-password/users/berwn
@@ -0,0 +1 @@
+../../../../../../sops/users/berwn
\ No newline at end of file