- add darman_password (sha-512 hash) to secrets/jupiter.yaml - neededForUsers so it lands in /run/secrets-for-users before user setup - real host uses hashedPasswordFile; VM keeps its test initialPassword Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>