should we generalize this? as this repeats with nested_root_pw and would repeat in orgs? (also note the implementation is different between root_pass and hw_profile)