diff --git a/deployment/check/common/targetNode.nix b/deployment/check/common/targetNode.nix
index 5ec8f47d..30299b0d 100644
--- a/deployment/check/common/targetNode.nix
+++ b/deployment/check/common/targetNode.nix
@@ -47,17 +47,23 @@ in
       ## Test VMs don't have a bootloader by default.
       boot.loader.grub.enable = false;
 
-      users.users.root.openssh.authorizedKeys.keys =
-        let
-          keys = import ../../../keys;
-        in
-        lib.attrValues keys.contributors
-        ++ [
-          # allow our panel vm access to the test machines
-          keys.panel
-          # allow continuous deployment access
-          keys.cd
-        ];
+      users.mutableUsers = false;
+      users.users.root = {
+        password = "password";
+        hashedPassword = null;
+        hashedPasswordFile = null;
+        openssh.authorizedKeys.keys =
+          let
+            keys = import ../../../keys;
+          in
+          lib.attrValues keys.contributors
+          ++ [
+            # allow our panel vm access to the test machines
+            keys.panel
+            # allow continuous deployment access
+            keys.cd
+          ];
+      };
     }
 
     (mkIf config.enableAcme {