diff --git a/nixos/modules/services/mail/tlsrpt.nix b/nixos/modules/services/mail/tlsrpt.nix
index 83b219443fd0..309ce400462c 100644
--- a/nixos/modules/services/mail/tlsrpt.nix
+++ b/nixos/modules/services/mail/tlsrpt.nix
@@ -50,6 +50,17 @@ let
     ];
   };
 
+  collectdConfigFile = format.generate "tlsrpt-collectd.cfg" {
+    tlsrpt_collectd = dropNullValues cfg.collectd.settings;
+  };
+  fetcherConfigFile = format.generate "tlsrpt-fetcher.cfg" {
+    tlsrpt_fetcher = dropNullValues cfg.fetcher.settings;
+  };
+  reportdConfigFile = format.generate "tlsrpt-reportd.cfg" {
+    tlsrpt_reportd = dropNullValues cfg.reportd.settings;
+  };
+
+  withPostfix = config.services.postfix.enable && cfg.configurePostfix;
 in
 
 {
@@ -117,14 +128,6 @@ in
           See {manpage}`tlsrpt-collectd(1)` for possible flags.
         '';
       };
-
-      configurePostfix = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Whether to modify the local Postfix service to grant access to the collectd socket.
-        '';
-      };
     };
 
     fetcher = {
@@ -229,9 +232,16 @@ in
 
             sendmail_script = mkOption {
               type = with types; nullOr str;
-              default = if config.services.postfix.enable then "sendmail" else null;
+              default =
+                if config.services.postfix.enable && config.services.postfix.setSendmail then
+                  "/run/wrappers/bin/sendmail -i -t"
+                else
+                  null;
               defaultText = lib.literalExpression ''
-                if any [ config.services.postfix.enable ] then "sendmail" else null
+                if config.services.postfix.enable && config.services.postfix.setSendmail then
+                  "/run/wrappers/bin/sendmail -i -t"
+                else
+                  null
               '';
               description = ''
                 Path to a sendmail-compatible executable for delivery reports.
@@ -255,19 +265,21 @@ in
         '';
       };
     };
+
+    configurePostfix = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to configure permissions to allow integration with Postfix.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
     environment.etc = {
-      "tlsrpt/collectd.cfg".source = format.generate "tlsrpt-collectd.cfg" {
-        tlsrpt_collectd = dropNullValues cfg.collectd.settings;
-      };
-      "tlsrpt/fetcher.cfg".source = format.generate "tlsrpt-fetcher.cfg" {
-        tlsrpt_fetcher = dropNullValues cfg.fetcher.settings;
-      };
-      "tlsrpt/reportd.cfg".source = format.generate "tlsrpt-reportd.cfg" {
-        tlsrpt_reportd = dropNullValues cfg.reportd.settings;
-      };
+      "tlsrpt/collectd.cfg".source = collectdConfigFile;
+      "tlsrpt/fetcher.cfg".source = fetcherConfigFile;
+      "tlsrpt/reportd.cfg".source = reportdConfigFile;
     };
 
     users.users.tlsrpt = {
@@ -276,11 +288,9 @@ in
     };
     users.groups.tlsrpt = { };
 
-    users.users.postfix.extraGroups =
-      lib.mkIf (config.services.postfix.enable && cfg.collectd.configurePostfix)
-        [
-          "tlsrpt"
-        ];
+    users.users.postfix.extraGroups = lib.mkIf withPostfix [
+      "tlsrpt"
+    ];
 
     systemd.services.tlsrpt-collectd = {
       description = "TLSRPT datagram collector";
@@ -288,7 +298,7 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
-      restartTriggers = [ "/etc/tlsrpt/collectd.cfg" ];
+      restartTriggers = [ collectdConfigFile ];
 
       serviceConfig = commonServiceSettings // {
         ExecStart = toString (
@@ -312,7 +322,7 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
-      restartTriggers = [ "/etc/tlsrpt/reportd.cfg" ];
+      restartTriggers = [ reportdConfigFile ];
 
       serviceConfig = commonServiceSettings // {
         ExecStart = toString (
@@ -324,7 +334,10 @@ in
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
+          "AF_NETLINK"
         ];
+        ReadWritePaths = lib.optionals withPostfix [ "/var/lib/postfix/queue/maildrop" ];
+        SupplementaryGroups = lib.optionals withPostfix [ "postdrop" ];
         UMask = "0077";
       };
     };