sshd under UsePAM no refuses the locked ('!') shadow entry Debian gives system users before pubkey auth runs. mountain-of-faith keeps PAM defaults so its restic user already works; it is aligned to keep the twin tasks interchangeable.

Assisted-by: GLM-5.3 via pi

diff --git a/legacy-of-lunatic-kingdom/main.yml b/legacy-of-lunatic-kingdom/main.yml
index a01ae51..c7b04a9 100644
--- a/legacy-of-lunatic-kingdom/main.yml
+++ b/legacy-of-lunatic-kingdom/main.yml
@@ -95,6 +95,10 @@
       ansible.builtin.user:
         name: restic
         system: true
+        # sshd's account check under UsePAM no refuses locked ('!') users,
+        # which is how Debian creates system users. '*' is not locked but
+        # can never match a password.
+        password: "*"
         state: present
 
     - name: Add SSH key for restic user
diff --git a/mountain-of-faith/main.yml b/mountain-of-faith/main.yml
index 46cbfa9..a526ec7 100644
--- a/mountain-of-faith/main.yml
+++ b/mountain-of-faith/main.yml
@@ -96,6 +96,9 @@
       ansible.builtin.user:
         name: restic
         system: true
+        # '*' rather than Debian's default locked '!': sshd under UsePAM no
+        # refuses locked users, and this play should match lolk's.
+        password: "*"
         state: present
 
     - name: Add SSH key for restic user