{config, ...}: {
  users.mutableUsers = false;
  system.autoUpgrade = {
    enable = true;
    flake = "git+${config.nix.registry.nixos.to.url}";
    flags = [
      "--update-input"
      "nixpkgs"
      "--no-write-lock-file"
      "-L" # print build logs
    ];
    dates = "02:00";
    randomizedDelaySec = "15min";
    allowReboot = true;
    rebootWindow = {
      lower = "02:00";
      upper = "05:00";
    };
  };
}