diff --git a/configs/baseline/airootfs/etc/shadow b/configs/baseline/airootfs/etc/shadow
new file mode 100644
index 0000000000000000000000000000000000000000..7edfd69bed55abe78ff06beec466b0da1cfa2fc2
--- /dev/null
+++ b/configs/baseline/airootfs/etc/shadow
@@ -0,0 +1 @@
+root::14871::::::
diff --git a/configs/baseline/build.sh b/configs/baseline/build.sh
index b86c7c83b07e3cbe647fab6bdad0e964beb48093..d28340847a964572d33d1f4b93738e208932e3a1 100755
--- a/configs/baseline/build.sh
+++ b/configs/baseline/build.sh
@@ -38,6 +38,16 @@ make_setup_mkinitcpio() {
         -r 'mkinitcpio -c /etc/mkinitcpio-archiso.conf -k /boot/vmlinuz-linux -g /boot/archiso.img' run
 }
 
+# Prepare working directory and copy custom airootfs files (airootfs)
+make_custom_airootfs() {
+    local _airootfs="${work_dir}/airootfs"
+
+    if [[ -d "${script_path}/airootfs" ]]; then
+        cp -af --no-preserve=ownership -- "${script_path}/airootfs/." "${_airootfs}"
+        [[ -e "${_airootfs}/etc/shadow" ]] && chmod -f 0400 -- "${_airootfs}/etc/shadow"
+    fi
+}
+
 # Prepare ${install_dir}/boot/
 make_boot() {
     mkdir -p "${work_dir}/iso/${install_dir}/boot/${arch}"
@@ -80,6 +90,7 @@ make_iso() {
 
 run_once make_basefs
 run_once make_setup_mkinitcpio
+run_once make_custom_airootfs
 run_once make_boot
 run_once make_syslinux
 run_once make_isolinux
diff --git a/configs/releng/airootfs/etc/passwd b/configs/releng/airootfs/etc/passwd
new file mode 100644
index 0000000000000000000000000000000000000000..2807d5d6f5a46f7eaa746e590941ea3ecf22202d
--- /dev/null
+++ b/configs/releng/airootfs/etc/passwd
@@ -0,0 +1 @@
+root:x:0:0:root:/root:/usr/bin/zsh
diff --git a/configs/releng/airootfs/etc/shadow b/configs/releng/airootfs/etc/shadow
new file mode 100644
index 0000000000000000000000000000000000000000..7edfd69bed55abe78ff06beec466b0da1cfa2fc2
--- /dev/null
+++ b/configs/releng/airootfs/etc/shadow
@@ -0,0 +1 @@
+root::14871::::::
diff --git a/configs/releng/airootfs/root/customize_airootfs.sh b/configs/releng/airootfs/root/customize_airootfs.sh
index bd9a7998c57c88deed807f7186da4a8eeee3ebf2..5c98fd6e98d0cdc460947dd6952e28b0b2ddc562 100755
--- a/configs/releng/airootfs/root/customize_airootfs.sh
+++ b/configs/releng/airootfs/root/customize_airootfs.sh
@@ -5,10 +5,7 @@ set -e -u
 sed -i 's/#\(en_US\.UTF-8\)/\1/' /etc/locale.gen
 locale-gen
 
-usermod -s /usr/bin/zsh root
 cp -aT /etc/skel/ /root/
-# unset the root password
-passwd -d root
 
 sed -i 's/#\(PermitRootLogin \).\+/\1yes/' /etc/ssh/sshd_config
 sed -i "s/#Server/Server/g" /etc/pacman.d/mirrorlist
diff --git a/configs/releng/build.sh b/configs/releng/build.sh
index 7e8321e596be58e16d321fccd7766864dfc19d08..327a193dd31532dc33746d29a790dad10eebf480 100755
--- a/configs/releng/build.sh
+++ b/configs/releng/build.sh
@@ -125,7 +125,8 @@ make_customize_airootfs() {
     fi
     rm "${work_dir}/x86_64/airootfs/root/customize_airootfs.sh"
 
-    chmod -f 750 "${work_dir}/x86_64/airootfs/root"
+    [[ -e "${work_dir}/x86_64/airootfs/etc/shadow" ]] && chmod -f 0400 -- "${work_dir}/x86_64/airootfs/etc/shadow"
+    [[ -e "${work_dir}/x86_64/airootfs/root" ]] && chmod -f 0750 -- "${work_dir}/x86_64/airootfs/root"
 }
 
 # Prepare kernel/initramfs ${install_dir}/boot/