diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index 0abf864a8fc7..20e1fdd0f2a1 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -29,6 +29,7 @@ let
     mkIf
     mkMerge
     mkOption
+    mkOrder
     mkPackageOption
     optional
     optionals
@@ -368,7 +369,7 @@ in
         freeformType = settingsFormat.type;
 
         options = {
-          pam_allowed_login_groups = mkOption {
+          kanidm.pam_allowed_login_groups = mkOption {
             description = "Kanidm groups that are allowed to login using PAM.";
             example = "my_pam_group";
             type = types.listOf types.str;
@@ -673,6 +674,10 @@ in
 
   config = mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
     warnings = lib.optionals (cfg.package.eolMessage != "") [ cfg.package.eolMessage ];
+    services.kanidm = {
+      unixSettings.version = "2";
+      serverSettings.version = "2";
+    };
 
     assertions =
       let
@@ -710,6 +715,14 @@ in
           };
       in
       [
+        {
+          assertion = cfg.enablePam -> !(cfg.unixSettings ? pam_allowed_login_groups);
+          message = ''
+            <option>services.kanidm.unixSettings.pam_allowed_login_groups</option> has been renamed
+            to <option>services.kanidm.unixSettings.kanidm.pam_allowed_login_groups</option>.
+            Please change your usage.
+          '';
+        }
         {
           assertion =
             !cfg.enableServer
@@ -1040,8 +1053,9 @@ in
 
     system.nssModules = mkIf cfg.enablePam [ cfg.package ];
 
-    system.nssDatabases.group = optional cfg.enablePam "kanidm";
-    system.nssDatabases.passwd = optional cfg.enablePam "kanidm";
+    # Needs to be before "files" which is `mkBefore`
+    system.nssDatabases.group = mkOrder 490 (optional cfg.enablePam "kanidm");
+    system.nssDatabases.passwd = mkOrder 490 (optional cfg.enablePam "kanidm");
 
     users.groups = mkMerge [
       (mkIf cfg.enableServer { kanidm = { }; })
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index 78f71fce90c6..c9fd7bb2a083 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -66,7 +66,7 @@ in
         };
         enablePam = true;
         unixSettings = {
-          pam_allowed_login_groups = [ "shell" ];
+          kanidm.pam_allowed_login_groups = [ "shell" ];
         };
       };