diff --git a/krebs/2configs/secret-passwords.nix b/krebs/2configs/secret-passwords.nix
new file mode 100644
index 000000000..5d265eba6
--- /dev/null
+++ b/krebs/2configs/secret-passwords.nix
@@ -0,0 +1,6 @@
+{ ... }: with import <stockholm/lib>;
+{
+  users.extraUsers =
+    mapAttrs (_: h: { hashedPassword = h; })
+             (import <secrets/hashedPasswords.nix>);
+}