{ ... }: {
  disko.devices.zpool.rpool = {
    rootFsOptions = {
      encryption = "aes-256-gcm";
      keyformat = "passphrase";

      keylocation = "prompt";
    };
    postCreateHook = ''
      zfs set keylocation="prompt" rpool
    '';
  };
}