When should a Django project use a custom user model, and what makes the decision difficult later?

I keep the authentication model small and stable because nearly every domain eventually references it. Before choosing email-only login, I decide how address changes, verification, duplicate casing, external identities, and account recovery work. Reusable apps never define their own user model; they depend on the project's swappable reference. Tests cover migrations from an empty database, admin creation, inactive users, identifier normalization, and every authentication backend that consumes the model.