diff --git a/mkosi.conf b/mkosi.conf
index 527d08a161..e6b0e41135 100644
--- a/mkosi.conf
+++ b/mkosi.conf
@@ -30,7 +30,6 @@ CacheDirectory=build/mkosi.cache
 
 [Content]
 BuildSourcesEphemeral=yes
-Autologin=yes
 
 ExtraTrees=
         mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key
@@ -134,7 +133,12 @@ Packages=
         zstd
 
 [Host]
-Credentials=journal.storage=persistent
+Credentials=
+        journal.storage=persistent
+        tty.serial.hvc0.agetty.autologin=root
+        tty.serial.hvc0.login.noauth=yes
+        tty.console.agetty.autologin=root
+        tty.console.login.noauth=yes
 Incremental=yes
 RuntimeBuildSources=yes
 RuntimeScratch=no
diff --git a/mkosi.conf.d/10-opensuse/mkosi.conf b/mkosi.conf.d/10-opensuse/mkosi.conf
index e741aa4a9c..dc9bf30429 100644
--- a/mkosi.conf.d/10-opensuse/mkosi.conf
+++ b/mkosi.conf.d/10-opensuse/mkosi.conf
@@ -43,6 +43,7 @@ Packages=
         glibc-locale-base
         gnutls
         grep
+        group(wheel)
         gzip
         iputils
         kernel-default
diff --git a/mkosi.postinst.chroot b/mkosi.postinst.chroot
index 7f2666e0a4..1809a302bc 100755
--- a/mkosi.postinst.chroot
+++ b/mkosi.postinst.chroot
@@ -3,7 +3,20 @@
 set -e
 set -o nounset
 
-useradd --uid 4711 --create-home --user-group testuser
+if [[ "$DISTRIBUTION" =~ ubuntu|debian ]]; then
+    SUDO_GROUP=sudo
+else
+    SUDO_GROUP=wheel
+fi
+
+useradd \
+    --uid 4711 \
+    --user-group \
+    --create-home \
+    --password "$(openssl passwd -1 testuser)" \
+    --groups "$SUDO_GROUP",systemd-journal \
+    --shell /bin/bash \
+    testuser
 
 if command -v authselect >/dev/null; then
     # authselect 1.5.0 renamed the minimal profile to the local profile without keeping backwards compat so