diff --git a/hosts/common/users/default.nix b/hosts/common/users/default.nix
index 1e09d300..7e40e58a 100644
--- a/hosts/common/users/default.nix
+++ b/hosts/common/users/default.nix
@@ -4,6 +4,7 @@
   imports = [
     ./colin.nix
     ./guest.nix
+    ./root.nix
   ];
 
   # Users are exactly these specified here;
diff --git a/hosts/common/users/root.nix b/hosts/common/users/root.nix
new file mode 100644
index 00000000..1cd8e28d
--- /dev/null
+++ b/hosts/common/users/root.nix
@@ -0,0 +1,10 @@
+{ ... }:
+{
+  sane.persist.sys.cryptClearOnBoot = [
+    # when running commands as root, some things may create ~/.cache entries.
+    # notably:
+    # - `/root/.cache/nix/` takes up ~10 MB on lappy/desko/servo
+    # - `/root/.cache/mesa_shader_cache` takes up 1-2 MB on moby
+    { path = "/root"; user = "root"; group = "root"; mode = "0700"; }
+  ];
+}