hook does not require cryptroot