upd

modules/nixos/disko/default.nix

@@ -143,8 +143,8 @@ in
               };
             };
           };
-          firmware = lib.mkIf cfg.enableFirmware {
-            device = "/dev/mmcblk0";
+          firmware = lib.mkIf cfg.firmware.enableFirmware {
+            device = cfg.firmware.firmwareDrive;
             type = "disk";
             imageSize = "1G";
             content = {

modules/nixos/disko/options.nix

@@ -19,7 +19,10 @@ in
 
     enableLuks = mkBoolOpt false "Enable Luks";
 
-    enableFirmware = mkBoolOpt false "Enable rpi firmware part";
+    firmware = {
+      enableFirmware = mkBoolOpt false "Enable rpi firmware part";
+      firmwareDisk = mkOpt types.str "/dev/mmcblk0" "UEFI firmware disk";
+    };
 
     swapSize = mkOpt types.str "16G" "size of swap part";
 

modules/nixos/user/default.nix

@@ -27,6 +27,8 @@ let
   ];
 
   defaultPasswordFile = config.sops.secrets."matt_password".path;
+
+  cfg.hashedPasswordFile = (if (cfg.hashedPassword == null && cfg.hashedPasswordFile == null && cfg.password == null) then defaultPasswordFile else null);
 in
 {
   options.${namespace}.user = with types; {

systems/aarch64-linux/pi4/default.nix

@@ -29,7 +29,10 @@
     hardware = {
       disko = {
         enable = true;
-        enableFirmware = false;
+        firmware = {
+          enableFirmware = true;
+          firmwareDisk = "/dev/mmcblk1";
+        };
       };
       raspberry-pi = {
         enable = true;