{ pkgs, ... }:
{
  users.users.openclaw = {
    isSystemUser = false;
    isNormalUser = true;
    home = "/home/openclaw";
    createHome = true;
    group = "openclaw";
    extraGroups = [ "docker" ];
    shell = pkgs.bash;
    description = "OpenClaw agent sandboxed user";
  };

  users.groups.openclaw = { };
}