Now it's placed between initrd-switch-root.target and initrd-switch-root.service, meaning it is truly the last thing to happen before switch-root, as it should be.
--replace-fail
with lib;
etc.overlay
systemd-sysusers