site/profiles/manifests/base.pp

@@ -28,7 +28,6 @@ class profiles::base (
     include profiles::base::hosts
     include profiles::base::groups
     include profiles::base::root
-    include profiles::accounts::sysadmin
     include profiles::ntp::client
     include profiles::dns::base
     include profiles::pki::vault

site/profiles/manifests/firstrun/init.pp

@@ -12,6 +12,9 @@ class profiles::firstrun::init {
   include profiles::base::facts
   include profiles::base::motd
 
+  # create the sysadmin account
+  include profiles::accounts::sysadmin
+
   # mark the firstrun as done
   include profiles::firstrun::complete