diff --git a/common.nix b/common.nix
index 36bd208..447de41 100644
--- a/common.nix
+++ b/common.nix
@@ -10,8 +10,9 @@ all: {
   boot.loader = {
     efi.canTouchEfiVariables = lib.mkDefault true;
     systemd-boot.editor = lib.mkDefault false;
-    # having a user makes sure `superusers=""` gets set, which prevents editing like the above
-    grub.users.grubby = {};
+    grub.extraConfig = ''
+      set superusers=""
+    '';
   };
 
   services.haveged.enable = lib.mkDefault true;