Regardless of mutable or immutable users, systemd-sysupdate never updates existing user records and thus will for example never change passwords for you. It only support initial passwords and now actively asserts agains other paswords.
--replace-fail