diff --git a/flake.lock b/flake.lock
index 08348709a..d58088a85 100644
--- a/flake.lock
+++ b/flake.lock
@@ -31,11 +31,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758160037,
-        "narHash": "sha256-fXelTdjdILspZ1IUU9aICB1+PXwSFiF8j+7ujwo1VpQ=",
+        "lastModified": 1758287904,
+        "narHash": "sha256-IGmaEf3Do8o5Cwp1kXBN1wQmZwQN3NLfq5t4nHtVtcU=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "4f554162fff88e77655073d352eec0cea71103a2",
+        "rev": "67ff9807dd148e704baadbd4fd783b54282ca627",
         "type": "github"
       },
       "original": {
diff --git a/flakeModules/demo_iso.nix b/flakeModules/demo_iso.nix
index b4bccfec7..fb8158afc 100644
--- a/flakeModules/demo_iso.nix
+++ b/flakeModules/demo_iso.nix
@@ -45,29 +45,33 @@ let
     '';
   };
 
-  morphModule = {
-    imports = [
-      (
-        { modulesPath, ... }:
-        {
-          imports = [ "${modulesPath}/image/images.nix" ];
-        }
-      )
-    ];
-    image.modules.iso.isoImage.squashfsCompression = "zstd -Xcompression-level 1";
-    networking.networkmanager.enable = true;
-    services.getty.autologinUser = "root";
-    programs.bash.interactiveShellInit = ''
-      if [[ "$(tty)" =~ /dev/(tty1|hvc0|ttyS0)$ ]]; then
-        # workaround for https://github.com/NixOS/nixpkgs/issues/219239
-        systemctl restart systemd-vconsole-setup.service
+  morphModule =
+    { config, ... }:
+    {
+      imports = [
+        (
+          { modulesPath, ... }:
+          {
+            imports = [ "${modulesPath}/image/images.nix" ];
+          }
+        )
+      ];
+      image.modules.iso.isoImage.squashfsCompression = "zstd -Xcompression-level 1";
+      networking.networkmanager.enable = true;
+      services.getty.autologinUser = "root";
+      programs.bash.interactiveShellInit = ''
+        if [[ "$(tty)" =~ /dev/(tty1|hvc0|ttyS0)$ ]]; then
+          # workaround for https://github.com/NixOS/nixpkgs/issues/219239
+          systemctl restart systemd-vconsole-setup.service
 
-        reset
+          reset
 
-        ${clan_welcome}/bin/clan_welcome
-      fi
-    '';
-  };
+          ${clan_welcome}/bin/clan_welcome
+        fi
+      '';
+
+      system.stateVersion = config.system.nixos.release;
+    };
 in
 {
   clan.templates.machine.demo-template = {
diff --git a/pkgs/installer/flake-module.nix b/pkgs/installer/flake-module.nix
index cbaf937a2..a2532b023 100644
--- a/pkgs/installer/flake-module.nix
+++ b/pkgs/installer/flake-module.nix
@@ -19,6 +19,8 @@ let
       system.stateVersion = config.system.nixos.release;
       nixpkgs.pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
 
+      users.users.root.initialHashedPassword = lib.mkForce null;
+
       boot.loader.grub.efiSupport = lib.mkDefault true;
       boot.loader.grub.efiInstallAsRemovable = lib.mkDefault true;
       disko.devices = {