From 28820e43631b4ca3a8235171968b0e6cd2479b2a Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Tue, 5 May 2026 12:58:20 +0200
Subject: [PATCH] nixos/google-compute-config: avoid IFD for modprobe blacklist

readFile on a derivation output forces a build during evaluation.
Symlink the upstream file via environment.etc instead, matching the
adjacent sysctl.d handling.
---
 nixos/modules/virtualisation/google-compute-config.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/virtualisation/google-compute-config.nix b/nixos/modules/virtualisation/google-compute-config.nix
index 8f9e2b4f4075..35ea7f439179 100644
--- a/nixos/modules/virtualisation/google-compute-config.nix
+++ b/nixos/modules/virtualisation/google-compute-config.nix
@@ -11,7 +11,6 @@ let
     mkDefault
     mkIf
     optional
-    readFile
     ;
 in
 
@@ -117,7 +116,8 @@ in
 
   users.groups.google-sudoers = mkIf config.users.mutableUsers { };
 
-  boot.extraModprobeConfig = readFile "${pkgs.google-guest-configs}/etc/modprobe.d/gce-blacklist.conf";
+  environment.etc."modprobe.d/gce-blacklist.conf".source =
+    "${pkgs.google-guest-configs}/etc/modprobe.d/gce-blacklist.conf";
 
   environment.etc."sysctl.d/60-gce-network-security.conf".source =
     "${pkgs.google-guest-configs}/etc/sysctl.d/60-gce-network-security.conf";