{ lib, ... }:
{
  users.mutableUsers = lib.mkForce true;
  security.polkit.extraConfig = ''
    polkit.addRule(function(action, subject) {
        if (action.id == "org.freedesktop.accounts.change-own-password") {
            if (subject.user == polkit.getUserForSubject(subject).getUserName()) {
                return polkit.Result.YES;
            }
        }
    });
  '';
}