diff --git a/nixos/hosts/phantom-ship.nix b/nixos/hosts/phantom-ship.nix
index 436320e..6370681 100644
--- a/nixos/hosts/phantom-ship.nix
+++ b/nixos/hosts/phantom-ship.nix
@@ -64,7 +64,7 @@ in
   users.users.danny = {
     isNormalUser = true;
     extraGroups = [ "wheel" ];
-    initialPassword = "changeme";  # console fallback; change after first login
+    # Password is locked (key-only SSH). Use NixOS installer or recovery to reset if needed.
   };
 
   # Key-only auth; no password or keyboard-interactive.