diff --git a/nixos/hosts/phantom-ship.nix b/nixos/hosts/phantom-ship.nix
index 6d52cad..afa71f7 100644
--- a/nixos/hosts/phantom-ship.nix
+++ b/nixos/hosts/phantom-ship.nix
@@ -20,6 +20,7 @@ in
   users.users.danny = {
     isNormalUser = true;
     extraGroups = [ "wheel" ];
+    initialPassword = "changeme";  # console fallback; change after first login
   };
 
   # Key-only auth; no password or keyboard-interactive.