{ ... }:
{
  # Default UMASK.
  # security.loginDefs.settings.UMASK = "077";

  # Disallow users modification outside of this config.
  users.mutableUsers = false;
}