diff --git a/ce-dev/ce-dev.compose.yml b/ce-dev/ce-dev.compose.yml
index c4a4e2188..dc2675206 100644
--- a/ce-dev/ce-dev.compose.yml
+++ b/ce-dev/ce-dev.compose.yml
@@ -1,19 +1,19 @@
 x-ce_dev:
-  version: 1.x
+  version: 2.x
   registry: localhost:5000
   project_name: provision
   provision:
     - ce-dev/ansible/setup.yml
 services:
   controller:
-    image: codeenigma/ce-dev-1.x:devel
+    image: codeenigma/ce-dev:2.x
     x-ce_dev: {}
     volumes:
       - ../:/home/ce-dev/ce-provision
     platform: linux/amd64
     cgroup: host
   target:
-    image: codeenigma/ce-dev-1.x:devel
+    image: codeenigma/ce-dev:2.x
     x-ce_dev:
       host_aliases:
         - provision-target.local
@@ -25,7 +25,7 @@ services:
     platform: linux/amd64
     cgroup: host
   privileged:
-    image: codeenigma/ce-dev-1.x:devel
+    image: codeenigma/ce-dev:2.x
     x-ce_dev:
       host_aliases:
         - provision-privileged.local
diff --git a/roles/debian/user_ansible/defaults/main.yml b/roles/debian/user_ansible/defaults/main.yml
index 5bec6c2c8..5357c1bf4 100644
--- a/roles/debian/user_ansible/defaults/main.yml
+++ b/roles/debian/user_ansible/defaults/main.yml
@@ -4,14 +4,15 @@ user_ansible:
   # This sets both username and main group.
   username: "{{ _user_ansible_username }}"
   home: "/home/{{ _user_ansible_username }}"
-  create: true # if you know the user already exists, set this to false to not create the user.
+  create: true  # if you know the user already exists, set this to false to not create the user.
   create_home: true
   update_password: "always"
+  system_user: true  # creates a system user - see useradd --system docs
   # It is often desirable to fix POSIX IDs for system users so they are consistent across your fleet
   # This is shown for documentation, you should do this in your config repo
   # uid: 999
   # gid: 999
-  sudo_config: {} # an empty dictionary will skip creating a sudo config
+  sudo_config: {}  # an empty dictionary will skip creating a sudo config
   # Example sudo config allowing full sudo permissions - see the debian/sudo_config role for more details.
   #  entity_name: "{{ _user_ansible_username }}"
   #  hosts: "ALL"
diff --git a/roles/debian/user_ansible/tasks/main.yml b/roles/debian/user_ansible/tasks/main.yml
index 454906b3e..93290f410 100644
--- a/roles/debian/user_ansible/tasks/main.yml
+++ b/roles/debian/user_ansible/tasks/main.yml
@@ -3,13 +3,13 @@
   ansible.builtin.group:
     name: "{{ user_ansible.username }}"
     gid: "{{ user_ansible.gid | default(omit) }}"
-    system: true
+    system: "{{ user_ansible.system_user }}"
 
 - name: Create additional groups.
   ansible.builtin.group:
     name: "{{ group }}"
     state: present
-    system: true
+    system: "{{ user_ansible.system_user }}"
   with_items: "{{ user_ansible.groups }}"
   loop_control:
     loop_var: group
@@ -21,7 +21,7 @@
     shell: /bin/bash
     group: "{{ user_ansible.username }}"
     uid: "{{ user_ansible.uid | default(omit) }}"
-    system: true
+    system: "{{ user_ansible.system_user }}"
     create_home: "{{ user_ansible.create_home }}"
     home: "{{ user_ansible.home }}"
     password: "*"
diff --git a/roles/debian/user_deploy/defaults/main.yml b/roles/debian/user_deploy/defaults/main.yml
index 718004a07..bd9aa0ac7 100644
--- a/roles/debian/user_deploy/defaults/main.yml
+++ b/roles/debian/user_deploy/defaults/main.yml
@@ -5,9 +5,10 @@ user_deploy:
   # If you are using ce-deploy to deploy code this must match the `deploy_user` variable
   username: "{{ _user_deploy_username }}"
   home: "/home/{{ _user_deploy_username }}"
-  create: true # if you know the user already exists, set this to false to not create the user.
+  create: true  # if you know the user already exists, set this to false to not create the user.
   create_home: true
   update_password: "always"
+  system_user: true  # creates a system user - see useradd --system docs
   # It is often desirable to fix POSIX IDs for system users so they are consistent across your fleet
   # This is shown for documentation, you should do this in your config repo
   # uid: 989
diff --git a/roles/debian/user_provision/defaults/main.yml b/roles/debian/user_provision/defaults/main.yml
index 6039727a2..177d2e74b 100644
--- a/roles/debian/user_provision/defaults/main.yml
+++ b/roles/debian/user_provision/defaults/main.yml
@@ -4,9 +4,10 @@ user_provision:
   # This sets both username and main group.
   username: "{{ _user_provision_username }}"
   home: "/home/{{ _user_provision_username }}"
-  create: true # if you know the user already exists, set this to false to not create the user.
+  create: true  # if you know the user already exists, set this to false to not create the user.
   create_home: true
   update_password: "always"
+  system_user: true  # creates a system user - see useradd --system docs
   # It is often desirable to fix POSIX IDs for system users so they are consistent across your fleet
   # This is shown for documentation, you should do this in your config repo
   # uid: 988