diff --git a/src/Tgstation.Server.Host/Controllers/ApiRootController.cs b/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
index 334eba85a4..5248d3f313 100644
--- a/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
@@ -263,13 +263,13 @@ namespace Tgstation.Server.Host.Controllers
 						return Unauthorized();
 
 					query = query.Where(
-						x => x.OAuthConnections.Any(
+						x => x.OAuthConnections!.Any(
 							y => y.Provider == oAuthProvider
 							&& y.ExternalUserId == externalUserId));
 				}
 				else
 				{
-					var canonicalUserName = Models.User.CanonicalizeName(ApiHeaders.Username);
+					var canonicalUserName = Models.User.CanonicalizeName(ApiHeaders.Username!);
 					if (canonicalUserName == Models.User.CanonicalizeName(Models.User.TgsSystemUserName))
 						return Unauthorized();
 
diff --git a/src/Tgstation.Server.Host/Jobs/JobsHubGroupMapper.cs b/src/Tgstation.Server.Host/Jobs/JobsHubGroupMapper.cs
index 6264c185d7..a961fbaef9 100644
--- a/src/Tgstation.Server.Host/Jobs/JobsHubGroupMapper.cs
+++ b/src/Tgstation.Server.Host/Jobs/JobsHubGroupMapper.cs
@@ -153,7 +153,7 @@ namespace Tgstation.Server.Host.Jobs
 					logger.LogTrace("RefreshHubGroups");
 					var permissionSetUsers = await databaseContext
 						.Users
-						.Where(x => x.PermissionSet.Id == permissionSetId)
+						.Where(x => x.PermissionSet!.Id == permissionSetId)
 						.ToListAsync(cancellationToken);
 					var allInstanceIds = await databaseContext
 						.Instances
diff --git a/src/Tgstation.Server.Host/Models/User.cs b/src/Tgstation.Server.Host/Models/User.cs
index 4c4e2c03b0..0939dd8042 100644
--- a/src/Tgstation.Server.Host/Models/User.cs
+++ b/src/Tgstation.Server.Host/Models/User.cs
@@ -6,8 +6,6 @@ using System.Linq;
 using Tgstation.Server.Api.Models;
 using Tgstation.Server.Api.Models.Response;
 
-#nullable disable
-
 namespace Tgstation.Server.Host.Models
 {
 	/// <inheritdoc cref="Api.Models.Internal.UserModelBase" />
@@ -21,17 +19,17 @@ namespace Tgstation.Server.Host.Models
 		/// <summary>
 		/// The hash of the user's password.
 		/// </summary>
-		public string PasswordHash { get; set; }
+		public string? PasswordHash { get; set; }
 
 		/// <summary>
 		/// See <see cref="UserResponse"/>.
 		/// </summary>
-		public User CreatedBy { get; set; }
+		public User? CreatedBy { get; set; }
 
 		/// <summary>
 		/// The <see cref="UserGroup"/> the <see cref="User"/> belongs to, if any.
 		/// </summary>
-		public UserGroup Group { get; set; }
+		public UserGroup? Group { get; set; }
 
 		/// <summary>
 		/// The ID of the <see cref="User"/>'s <see cref="UserGroup"/>.
@@ -41,14 +39,14 @@ namespace Tgstation.Server.Host.Models
 		/// <summary>
 		/// The <see cref="PermissionSet"/> the <see cref="User"/> has, if any.
 		/// </summary>
-		public PermissionSet PermissionSet { get; set; }
+		public PermissionSet? PermissionSet { get; set; }
 
 		/// <summary>
 		/// The uppercase invariant of <see cref="UserName.Name"/>.
 		/// </summary>
 		[Required]
 		[StringLength(Limits.MaximumIndexableStringLength, MinimumLength = 1)]
-		public string CanonicalName { get; set; }
+		public string? CanonicalName { get; set; }
 
 		/// <summary>
 		/// When <see cref="PasswordHash"/> was last changed.
@@ -58,17 +56,17 @@ namespace Tgstation.Server.Host.Models
 		/// <summary>
 		/// <see cref="User"/>s created by this <see cref="User"/>.
 		/// </summary>
-		public ICollection<User> CreatedUsers { get; set; }
+		public ICollection<User>? CreatedUsers { get; set; }
 
 		/// <summary>
 		/// The <see cref="TestMerge"/>s made by the <see cref="User"/>.
 		/// </summary>
-		public ICollection<TestMerge> TestMerges { get; set; }
+		public ICollection<TestMerge>? TestMerges { get; set; }
 
 		/// <summary>
 		/// The <see cref="TestMerge"/>s made by the <see cref="User"/>.
 		/// </summary>
-		public ICollection<OAuthConnection> OAuthConnections { get; set; }
+		public ICollection<OAuthConnection>? OAuthConnections { get; set; }
 
 		/// <summary>
 		/// Change a <see cref="UserName.Name"/> into a <see cref="CanonicalName"/>.
diff --git a/src/Tgstation.Server.Host/Security/AuthenticationContext.cs b/src/Tgstation.Server.Host/Security/AuthenticationContext.cs
index c40d122743..61c6c36f44 100644
--- a/src/Tgstation.Server.Host/Security/AuthenticationContext.cs
+++ b/src/Tgstation.Server.Host/Security/AuthenticationContext.cs
@@ -56,7 +56,7 @@ namespace Tgstation.Server.Host.Security
 			if (systemIdentity == null && User.SystemIdentifier != null)
 				throw new ArgumentNullException(nameof(systemIdentity));
 			permissionSet = user.PermissionSet
-				?? user.Group.PermissionSet
+				?? user.Group!.PermissionSet
 				?? throw new ArgumentException("No PermissionSet provider", nameof(user));
 			InstancePermissionSet = instanceUser;
 			SystemIdentity = systemIdentity;
diff --git a/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs b/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
index 7fa7b2802f..ad9ecf014f 100644
--- a/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
+++ b/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
@@ -88,7 +88,7 @@ namespace Tgstation.Server.Host.Security
 				.Include(x => x.CreatedBy)
 				.Include(x => x.PermissionSet)
 				.Include(x => x.Group)
-					.ThenInclude(x => x.PermissionSet)
+					.ThenInclude(x => x!.PermissionSet)
 				.Include(x => x.OAuthConnections)
 				.FirstOrDefaultAsync(cancellationToken);
 			if (user == default)
@@ -111,7 +111,7 @@ namespace Tgstation.Server.Host.Security
 				systemIdentity = null;
 			}
 
-			var userPermissionSet = user.PermissionSet ?? user.Group.PermissionSet;
+			var userPermissionSet = user.PermissionSet ?? user.Group!.PermissionSet;
 			try
 			{
 				InstancePermissionSet? instancePermissionSet = null;
diff --git a/src/Tgstation.Server.Host/Security/CryptographySuite.cs b/src/Tgstation.Server.Host/Security/CryptographySuite.cs
index d98e61c303..6a401e7575 100644
--- a/src/Tgstation.Server.Host/Security/CryptographySuite.cs
+++ b/src/Tgstation.Server.Host/Security/CryptographySuite.cs
@@ -55,6 +55,9 @@ namespace Tgstation.Server.Host.Security
 			ArgumentNullException.ThrowIfNull(user);
 			ArgumentNullException.ThrowIfNull(password);
 
+			if (user.PasswordHash == null)
+				throw new ArgumentException("user must have PasswordHash!", nameof(user));
+
 			var result = passwordHasher.VerifyHashedPassword(user, user.PasswordHash, password);
 			switch (result)
 			{