From 9b869f92d31eec04fa909483f14d0f45b6ec6f13 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Tue, 9 Jun 2026 19:27:59 +0300
Subject: [PATCH 1/2] nixos/networkmanager: convert tmpfiles to structured
 settings

---
 .../services/networking/networkmanager.nix    | 26 ++++++++++++++-----
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 2cb3532471c8..a5e95338820d 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -601,13 +601,27 @@ in
 
     systemd.packages = packages;
 
-    systemd.tmpfiles.rules = [
-      "d /etc/NetworkManager/system-connections 0700 root root -"
-      "d /var/lib/misc 0755 root root -" # for dnsmasq.leases
+    systemd.tmpfiles.settings.networkmanager = {
+      "/etc/NetworkManager/system-connections".d = {
+        mode = "0700";
+        user = "root";
+        group = "root";
+      };
+      # for dnsmasq.leases
+      "/var/lib/misc".d = {
+        mode = "0755";
+        user = "root";
+        group = "root";
+      };
       # ppp isn't able to mkdir that directory at runtime
-      "d /run/pppd/lock 0700 root root -"
-    ]
-    ++ pluginTmpfilesRules;
+      "/run/pppd/lock".d = {
+        mode = "0700";
+        user = "root";
+        group = "root";
+      };
+    };
+
+    systemd.tmpfiles.rules = pluginTmpfilesRules;
 
     systemd.services.NetworkManager = {
       wantedBy = [ "multi-user.target" ];

From 9c5f40193601f46055753a931d17654a9df593ba Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Tue, 9 Jun 2026 19:41:37 +0300
Subject: [PATCH 2/2] nixos/networkmanager: create the correct configured
 keyfile.path

---
 nixos/modules/services/networking/networkmanager.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index a5e95338820d..06052496d6e4 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -24,6 +24,9 @@ let
       rc-manager = if config.networking.resolvconf.enable then "resolvconf" else "unmanaged";
     };
     keyfile = {
+      # NM's compiled-in default; made explicit so the tmpfiles rule below
+      # can follow it when the user redirects the keyfile store elsewhere.
+      path = "/etc/NetworkManager/system-connections";
       unmanaged-devices = if cfg.unmanaged == [ ] then null else lib.concatStringsSep ";" cfg.unmanaged;
     };
     logging = {
@@ -602,7 +605,7 @@ in
     systemd.packages = packages;
 
     systemd.tmpfiles.settings.networkmanager = {
-      "/etc/NetworkManager/system-connections".d = {
+      ${configAttrs.keyfile.path}.d = {
         mode = "0700";
         user = "root";
         group = "root";