anchor.diff:          # there is at least one "privileged" account that has a
           # password or an SSH authorized key. Privileged accounts are
           # root and users in the wheel group.
  -        assertion = !cfg.mutableUsers ->
  -          any id ((mapAttrsToList (_: cfg:
  -            (cfg.name == "root"
  +        # The check does not apply when users.disableLoginPossibilityAssertion
  +        # The check does not apply when users.mutableUsers
  +        assertion = !cfg.mutableUsers -> !cfg.allowNoPasswordLogin ->
  +          any id (mapAttrsToList (name: cfg:
  +            (name == "root"
                || cfg.group == "wheel"
                || elem "wheel" cfg.extraGroups)
               &&
  
positive.code:   imports = [
      (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
      (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
      (mkChangedOptionModule
        [ "security" "initialRootPassword" ]
        [ "users" "users" "root" "initialHashedPassword" ]
        (cfg: if cfg.security.initialRootPassword == "!"
              then null
              else cfg.security.initialRootPassword))
    ];
  
    ###### interface
  
    options = {
  
      users.mutableUsers = mkOption {
  
negative.code:       '';
      };
  
  
      users.allowNoPasswordLogin = mkOption {
        type = types.bool;
        default = false;
        description = ''
          Disable checking that at least the <literal>root</literal> user or a user in the <literal>wheel</literal> group can log in using
          a password or an SSH key.
  
          WARNING: enabling this can lock you out of your system. Enable this only if you know what are you doing.
        '';
      };
    };
  
  
  