diff --git a/nixops/desktop.nix b/nixops/desktop.nix
index a1f63e8..c9d25bc 100644
--- a/nixops/desktop.nix
+++ b/nixops/desktop.nix
@@ -111,6 +111,7 @@ in
   programs.fish.promptInit = ''
     fish-nix-shell --info-right | source
   '';
+  users.mutableUsers = false;
   users.defaultUserShell = pkgs.fish;
   users.extraGroups.plugdev = { };
   users.extraUsers = (import ./common-users.nix);
diff --git a/nixops/light.nix b/nixops/light.nix
index 39fb23a..987d3d0 100644
--- a/nixops/light.nix
+++ b/nixops/light.nix
@@ -93,6 +93,7 @@
   programs.fish.promptInit = ''
     fish-nix-shell --info-right | source
   '';
+  users.mutableUsers = false;
   users.defaultUserShell = pkgs.fish;
   users.extraGroups.plugdev = { };
   users.extraUsers = (import ./common-users.nix);
diff --git a/nixops/rpi.nix b/nixops/rpi.nix
index 725fe8a..bd2d904 100644
--- a/nixops/rpi.nix
+++ b/nixops/rpi.nix
@@ -39,15 +39,15 @@ in
   networking.hostName = host;
   time.timeZone = "Asia/Hong_Kong";
 
-  programs.wireshark.enable = true;
-
   users.extraGroups.plugdev = { };
-  security.sudo.wheelNeedsPassword = false;
+  users.mutableUsers = false;
+  users.defaultUserShell = pkgs.fish;
   users.extraUsers = (import ./common-users.nix) // {
     nix = {
       isNormalUser = true;
     };
   };
+  security.sudo.wheelNeedsPassword = false;
   services.udev.packages = [ m-labs.openocd ];
 
   documentation.enable = false;
@@ -55,7 +55,7 @@ in
     psmisc wget vim git usbutils lm_sensors file telnet mosh tmux xc3sprog m-labs.openocd screen gdb minicom picocom
   ];
   programs.fish.enable = true;
-  users.defaultUserShell = pkgs.fish;
+  programs.wireshark.enable = true;
 
   nix.binaryCachePublicKeys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
   nix.binaryCaches = ["https://cache.nixos.org" "https://nixbld.m-labs.hk"];