diff --git a/installer.nix b/installer.nix
index 96da7f1..6c6a64b 100644
--- a/installer.nix
+++ b/installer.nix
@@ -130,7 +130,7 @@ in {
       openssh = {
         enable = true;
         # This is set in modules/profiles/installation-device.nix, but it is set to 'yes' :(
-        #permitRootLogin = "prohibit-password";
+        permitRootLogin = lib.mkForce "prohibit-password";
         passwordAuthentication = false;
       };
     };