Set users.mutableUsers to false to make all user creation declarative. All users now must be defined in configuration.nix and make sure they have hashed passwords set.