The solution works in some way, but it has a devastating bug, where the orignal password is no longer required to change the password, see: [PAM Password quality] change password allowed using wrong credentials · Issue #287420 · NixOS/nixpkgs · GitHub