{lib, ...}: let
  inherit (lib.modules) mkDefault;
in {
  boot.encryptedDrive = {
    enable = true;
    mode = mkDefault "encrypted-usb";
    allowPasswordDecrypt = mkDefault true;
  };
}