{ config, lib, ... }: {
  options =
  let
    vmVariantOptions = {
      users.sopsPasswordOverride = {
        enable = lib.mkEnableOption "sops password override" // {
          default = false;
        };

        password = lib.mkOption {
          type = lib.types.nullOr (lib.types.passwdEntry lib.types.str);
          default = null;
        };

        hashedPassword = lib.mkOption {
          type = lib.types.nullOr (lib.types.passwdEntry lib.types.str);
          default = null;
        };
      };
    };
  in {
    virtualisation = {
      vmVariant = vmVariantOptions;
      vmVariantWithBootLoader = vmVariantOptions;
    };
  };

  config = {
    users.users =
      with { inherit (config.virtualisation.vmVariantWithBootLoader.users) sopsPasswordOverride; };
      (lib.mkIf
        sopsPasswordOverride.enable
        (
          builtins.listToAttrs (
            builtins.map (
              name: {
                inherit name;

                value = {
                  hashedPasswordFile = lib.mkVMOverride null;
                  hashedPassword = sopsPasswordOverride.hashedPassword;
                  password = sopsPasswordOverride.password;
                };
              })
            (builtins.filter
              (
                name:
                  let
                    user = config.users.users.${name};
                  in
                    (
                      (user.hashedPasswordFile != null) &&
                      (lib.strings.hasPrefix "/run/secrets-for-users/" user.hashedPasswordFile)
                    ))
              (builtins.attrNames config.users.users)))));
  };
}