anchor.diff:  
     # Note: the 'X' in front of the password is to distinguish between
     # having an empty password, and not having a password.
  -  serializedUser = u: "${u.name}\n${u.description}\n${toString u.uid}\n${u.group}\n${toString (concatStringsSep "," u.extraGroups)}\n${u.home}\n${u.shell}\n${toString u.createHome}\n${if u.password != null then "X" + u.password else ""}\n";
  +  serializedUser = u: "${u.name}\n${u.description}\n${toString u.uid}\n${u.group}\n${toString (concatStringsSep "," u.extraGroups)}\n${u.home}\n${u.shell}\n${toString u.createHome}\n${if u.password != null then "X" + u.password else ""}\n${toString u.isSystemUser}\n";
     serializedGroup = g: "${g.name}\n${toString g.gid}";
     
     # keep this extra file so that cat can be used to pass special chars such as "`" which is used in the avahi daemon
  
positive.code:             read shell
              read createHome
              read password
  
              if ! curEnt=$(getent passwd "$name"); then
                  useradd --system \
                      --comment "$description" \
                      ''${uid:+--uid $uid} \
                      --gid "$group" \
  
negative.code:           }
          ];
  
        # !!! Use NixOS module system to add default attributes.
        addAttrs =
          { name
          , description
  