diff --git a/bin/lib/installation.nix b/bin/lib/installation.nix
index 45df5d7804a596da3d0a4244d10d56c419ca0035..fad135e12b9413b8860ab719b7117990c459eeca 100644
--- a/bin/lib/installation.nix
+++ b/bin/lib/installation.nix
@@ -41,12 +41,16 @@ assert (typeOf swap) == "string";
     set -u
     set -o pipefail
 
+    ${if luks then ''
+      read -r -s "luks?Please enter the new LUKS passphrase:"
+    '' else ""}
+
     # Generate config
     <<EOF
     {
       "blockDevice": null
       ${if luks then ''
-        ,"luksKey": "foobar"
+        ,"luksKey": "$luks"
       '' else ""}
     }
     EOF