Also change the SSH host keys as they are preconfigured (the same) on all downloads on some ARM devices and it goes without saying change the root passphrase.