From fb5b3c5c30f3d3adb0b8d0e59d79ddf5198770a5 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Thu, 5 Mar 2026 02:58:30 -0700
Subject: [PATCH 1/2] libvirt: fix virt-secret-init-encryption

---
 pkgs/by-name/li/libvirt/package.nix | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libvirt/package.nix b/pkgs/by-name/li/libvirt/package.nix
index e8544e5204b6..b1b7ef54b02b 100644
--- a/pkgs/by-name/li/libvirt/package.nix
+++ b/pkgs/by-name/li/libvirt/package.nix
@@ -33,11 +33,13 @@
   python3,
   readline,
   rpcsvc-proto,
+  runtimeShell,
   stdenv,
   replaceVars,
   xhtml1,
   json_c,
   writeScript,
+  writeShellApplication,
   nixosTests,
 
   # Linux
@@ -179,7 +181,23 @@ stdenv.mkDerivation rec {
     sed -i '/libxlxml2domconfigtest/d' tests/meson.build
     substituteInPlace src/libxl/libxl_capabilities.h \
      --replace-fail /usr/lib/xen ${xen}/libexec/xen
-  '';
+  ''
+  + lib.optionalString isLinux (
+    let
+      script = writeShellApplication {
+        name = "virt-secret-init-encryption-sh";
+        runtimeInputs = [
+          coreutils
+          systemd
+        ];
+        text = ''exec ${runtimeShell} "$@"'';
+      };
+    in
+    ''
+      substituteInPlace src/secret/virt-secret-init-encryption.service.in \
+        --replace-fail /usr/bin/sh ${lib.getExe script}
+    ''
+  );
 
   strictDeps = true;
 

From d699415ebe3add131044bcfd355ed1aa849bb646 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Thu, 5 Mar 2026 16:33:04 -0700
Subject: [PATCH 2/2] nixos/libvirtd: add secrets to StateDirectory

---
 nixos/modules/virtualisation/libvirtd.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index 7bca79260362..d7313a0bcc57 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -530,7 +530,10 @@ in
           "nix-helpers"
           "nix-ovmf"
         ];
-        StateDirectory = subDirs [ "dnsmasq" ];
+        StateDirectory = subDirs [
+          "dnsmasq"
+          "secrets"
+        ];
       };
     };