I was worried about the headless setup, but apparently you can create a user in the official imager tool.

I guess I'll go make a fork of the OS that keeps the default credentials. No way am I getting locked out of some stupid robot or whatever because I can't remember the password!

I wish more of the Raspberry Pi were configurable from /boot. You should be able to drop a cloud-init file in there or something similar.

It breaks some python scripts which expect that pi is a variable.