diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index db9f28ac94c1..6aead49606af 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -1115,14 +1115,19 @@ in
             -> !cfg.allowNoPasswordLogin
             -> any id (
               mapAttrsToList (
-                name: cfg:
-                (name == "root" || cfg.group == "wheel" || elem "wheel" cfg.extraGroups)
+                name: user:
+                (
+                  name == "root"
+                  || user.group == "wheel"
+                  || elem "wheel" user.extraGroups
+                  || elem name (cfg.groups.wheel.members or [ ])
+                )
                 && (
-                  allowsLogin cfg.hashedPassword
-                  || cfg.password != null
-                  || cfg.hashedPasswordFile != null
-                  || cfg.openssh.authorizedKeys.keys != [ ]
-                  || cfg.openssh.authorizedKeys.keyFiles != [ ]
+                  allowsLogin user.hashedPassword
+                  || user.password != null
+                  || user.hashedPasswordFile != null
+                  || user.openssh.authorizedKeys.keys != [ ]
+                  || user.openssh.authorizedKeys.keyFiles != [ ]
                 )
               ) cfg.users
               ++ [