diff --git a/hosts/common/programs/unl0kr/default.nix b/hosts/common/programs/unl0kr/default.nix
index 6220c87e..acb5d506 100644
--- a/hosts/common/programs/unl0kr/default.nix
+++ b/hosts/common/programs/unl0kr/default.nix
@@ -50,8 +50,11 @@ in
         };
         options.user = mkOption {
           type = types.str;
-          # TODO: derive this from sane.programs...enableFor.user.* info
-          default = "colin";
+          description = ''
+            which user to login by default.
+            unl0kr is just a virtual keyboard for entering a password: one has to choose the user to login before launching it.
+            on a typical single-user install, leave this unset and the user will be chosen based on who this package is installed for.
+          '';
         };
         options.afterLogin = mkOption {
           type = types.nullOr types.str;
@@ -76,10 +79,16 @@ in
             exposed for debugging.
           '';
         };
+
+        config = lib.mkMerge (lib.mapAttrsToList
+          (userName: en: lib.optionalAttrs en {
+            user = lib.mkDefault userName;
+          })
+          cfg.enableFor.user
+        );
       };
     };
 
-
     # lib.mkAfter so that launching the DE happens *after* any other .profile setup.
     # alternatively, we could recurse: exec a new login shell with some env-var signalling to not launch the DE,
     #   run with `-c "{cfg.afterLogin}"`