{ adminUser, ... }:
{
  nix.settings.trusted-users = [ "builder" ];

  users.users.builder = {
    openssh.authorizedKeys.keys =
      with adminUser.userinfo.sshPublicKeys;
      [
        onepassword
        yubikey-personal-nano
        yubikey-personal-keychain
        yubikey-personal-backup
      ]
      ++ [
        # remote builder ssh key
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFGxdplt9WwGjdhoYkmPe2opZMJShtpqnGCI+swrgvw"
      ];
    isNormalUser = true;
    group = "nogroup";
  };
}