diff --git a/README.md b/README.md
index 3cab6ec..2ef35e8 100644
--- a/README.md
+++ b/README.md
@@ -179,9 +179,9 @@ The following environment variables are supported:
 
    Username for the first user
 
- * `FIRST_USER_PASS` (Default: "raspberry")
+ * `FIRST_USER_PASS` (Default: unset)
 
-   Password for the first user
+   Password for the first user. If unset, the account is locked.
 
  * `WPA_ESSID`, `WPA_PASSWORD` and `WPA_COUNTRY` (Default: unset)
 
diff --git a/build.sh b/build.sh
index 4b75e79..014035c 100755
--- a/build.sh
+++ b/build.sh
@@ -224,7 +224,7 @@ export LOG_FILE="${WORK_DIR}/build.log"
 export TARGET_HOSTNAME=${TARGET_HOSTNAME:-raspberrypi}
 
 export FIRST_USER_NAME=${FIRST_USER_NAME:-pi}
-export FIRST_USER_PASS=${FIRST_USER_PASS:-raspberry}
+export FIRST_USER_PASS
 export RELEASE=${RELEASE:-bullseye}
 export WPA_ESSID
 export WPA_PASSWORD
diff --git a/export-image/01-user-rename/00-packages b/export-image/01-user-rename/00-packages
new file mode 100644
index 0000000..e8b69fc
--- /dev/null
+++ b/export-image/01-user-rename/00-packages
@@ -0,0 +1 @@
+userconf-pi
diff --git a/export-image/01-user-rename/01-run.sh b/export-image/01-user-rename/01-run.sh
new file mode 100755
index 0000000..8a5617b
--- /dev/null
+++ b/export-image/01-user-rename/01-run.sh
@@ -0,0 +1,5 @@
+#!/bin/bash -e
+
+on_chroot << EOF
+	SUDO_USER="${FIRST_USER_NAME}" rename-user -f -s
+EOF
diff --git a/export-image/01-set-sources/01-run.sh b/export-image/02-set-sources/01-run.sh
similarity index 100%
rename from export-image/01-set-sources/01-run.sh
rename to export-image/02-set-sources/01-run.sh
diff --git a/export-image/02-network/01-run.sh b/export-image/03-network/01-run.sh
similarity index 100%
rename from export-image/02-network/01-run.sh
rename to export-image/03-network/01-run.sh
diff --git a/export-image/02-network/files/resolv.conf b/export-image/03-network/files/resolv.conf
similarity index 100%
rename from export-image/02-network/files/resolv.conf
rename to export-image/03-network/files/resolv.conf
diff --git a/export-image/03-set-partuuid/00-run.sh b/export-image/04-set-partuuid/00-run.sh
similarity index 100%
rename from export-image/03-set-partuuid/00-run.sh
rename to export-image/04-set-partuuid/00-run.sh
diff --git a/export-image/04-finalise/01-run.sh b/export-image/05-finalise/01-run.sh
similarity index 100%
rename from export-image/04-finalise/01-run.sh
rename to export-image/05-finalise/01-run.sh
diff --git a/stage1/01-sys-tweaks/00-run.sh b/stage1/01-sys-tweaks/00-run.sh
index 9c380ec..0f761bd 100755
--- a/stage1/01-sys-tweaks/00-run.sh
+++ b/stage1/01-sys-tweaks/00-run.sh
@@ -8,7 +8,10 @@ on_chroot << EOF
 if ! id -u ${FIRST_USER_NAME} >/dev/null 2>&1; then
 	adduser --disabled-password --gecos "" ${FIRST_USER_NAME}
 fi
-echo "${FIRST_USER_NAME}:${FIRST_USER_PASS}" | chpasswd
+
+if [ -n "${FIRST_USER_PASS}" ]; then
+	echo "${FIRST_USER_NAME}:${FIRST_USER_PASS}" | chpasswd
+fi
 echo "root:root" | chpasswd
 EOF
 
diff --git a/stage4/00-install-packages/00-packages b/stage4/00-install-packages/00-packages
index 559e3d2..f8461a9 100644
--- a/stage4/00-install-packages/00-packages
+++ b/stage4/00-install-packages/00-packages
@@ -22,3 +22,5 @@ piwiz
 rp-prefapps
 ffmpeg
 vlc
+rpi-imager
+rpi-wayland