diff --git a/modules/users/default.nix b/modules/users/default.nix
index ce77d4d9..0cb43503 100644
--- a/modules/users/default.nix
+++ b/modules/users/default.nix
@@ -148,7 +148,7 @@ in
     system.activationScripts.users.text = mkIf (cfg.knownUsers != []) ''
       echo "setting up users..." >&2
 
-      deleteUser() {
+      requireFDA() {
         fullDiskAccess=false
 
         if cat /Library/Preferences/com.apple.TimeMachine.plist > /dev/null 2>&1; then
@@ -156,9 +156,9 @@ in
         fi
 
         if [[ "$fullDiskAccess" != true ]]; then
-          printf >&2 '\e[1;31merror: users cannot be deleted without Full Disk Access, aborting activation\e[0m\n'
-          printf >&2 'The user %s could not be deleted as `darwin-rebuild` was not executed with Full Disk Access.' "$1"
-
+          printf >&2 '\e[1;31merror: users cannot be %s without Full Disk Access, aborting activation\e[0m\n' "$2"
+          printf >&2 'The user %s could not be %s as `darwin-rebuild` was not executed with Full Disk Access.\n' "$1" "$2"
+          printf >&2 '\n'
           printf >&2 'Opening "Privacy & Security" > "Full Disk Access" in System Settings\n'
           printf >&2 '\n'
           # This command will fail if run as root and System Settings is already running
@@ -175,10 +175,26 @@ in
 
           exit 1
         fi
+      }
 
-        sysadminctl -deleteUser "$1" 2> /dev/null
+      deleteUser() {
+        # FIXME: add `darwin.primaryUser` as well
+        if [[ "$1" == "$SUDO_USER" ]]; then
+          printf >&2 '\e[1;31merror: refusing to delete the user calling `darwin-rebuild` (%s), aborting activation\e[0m\n', "$1"
+          exit 1
+        elif [[ "$1" == "root" ]]; then
+          printf >&2 '\e[1;31merror: refusing to delete `root`, aborting activation\e[0m\n', "$1"
+          exit 1
+        fi
 
-        if id -u "$1" > /dev/null 2>&1; then
+        requireFDA "$1" deleted
+
+        dscl . -delete "/Users/$1" 2> /dev/null
+
+        # `dscl . -delete` should exit with a non-zero exit code when there's an error, but we'll leave
+        # this code here just in case and for when we switch to `sysadminctl -deleteUser`
+        # We need to check as `sysadminctl -deleteUser` still exits with exit code 0 when there's an error
+        if id "$1" &> /dev/null; then
           printf >&2 '\e[1;31merror: failed to delete user %s, aborting activation\e[0m\n', "$1"
           exit 1
         fi
@@ -191,8 +207,15 @@ in
         ${optionalString cfg.forceRecreate ''
           u=$(id -u ${name} 2> /dev/null) || true
           if [[ "$u" -eq ${toString v.uid} ]]; then
-            echo "deleting user ${v.name}..." >&2
-            deleteUser ${name}
+            # TODO: add `darwin.primaryUser` as well
+            if [[ ${name} == "$SUDO_USER" ]]; then
+              printf >&2 'warning: not going to recreate the user calling `darwin-rebuild` (%s), skipping...\n' "$SUDO_USER"
+            elif [[ ${name} == "root" ]]; then
+              printf >&2 'warning: not going to recreate root, skipping...\n'
+            else
+              printf >&2 'deleting user ${v.name}...\n'
+              deleteUser ${name}
+            fi
           else
             echo "warning: existing user '${v.name}' has unexpected uid $u, skipping..." >&2
           fi
@@ -204,7 +227,17 @@ in
         else
           if [ -z "$u" ]; then
             echo "creating user ${v.name}..." >&2
-            sysadminctl -addUser ${lib.escapeShellArgs ([ v.name "-UID" v.uid "-GID" v.gid ] ++ (lib.optionals (v.description != null) [ "-fullName" v.description ]) ++ [ "-home" v.home "-shell" (shellPath v.shell) ])}
+
+            requireFDA ${name} "created"
+
+            sysadminctl -addUser ${lib.escapeShellArgs ([ v.name "-UID" v.uid "-GID" v.gid ] ++ (lib.optionals (v.description != null) [ "-fullName" v.description ]) ++ [ "-home" v.home "-shell" (shellPath v.shell) ])} 2> /dev/null
+
+            # We need to check as `sysadminctl -addUser` still exits with exit code 0 when there's an error
+            if ! id ${name} &> /dev/null; then
+              printf >&2 '\e[1;31merror: failed to create user %s, aborting activation\e[0m\n' ${name}
+              exit 1
+            fi
+
             dscl . -create ${dsclUser} IsHidden ${if v.isHidden then "1" else "0"}
             ${optionalString v.createHome "createhomedir -cu ${name}"}
           fi