From 39e93806aa7560e5b5bf06d344698d893cc045cf Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Fri, 31 Oct 2025 11:03:32 +0100
Subject: [PATCH] Revert "various: replace
 `systemd.services.<name>.{script,preStart}` with `ExecStart{,Pre}`"

---
 nixos/modules/security/soteria.nix            |  2 +-
 .../services/blockchain/ethereum/geth.nix     | 68 +++++++++----------
 .../services/computing/boinc/client.nix       |  4 +-
 .../services/computing/slurm/slurm.nix        |  6 +-
 .../services/games/minetest-server.nix        |  9 ++-
 nixos/modules/services/hardware/pommed.nix    |  2 +-
 .../services/home-automation/zigbee2mqtt.nix  |  4 +-
 nixos/modules/services/logging/heartbeat.nix  |  4 +-
 .../modules/services/logging/journalbeat.nix  |  8 +--
 .../services/logging/journaldriver.nix        |  2 +-
 nixos/modules/services/logging/promtail.nix   |  5 +-
 nixos/modules/services/logging/syslog-ng.nix  |  2 +-
 nixos/modules/services/mail/cyrus-imap.nix    |  4 +-
 nixos/modules/services/mail/dkimproxy-out.nix |  4 +-
 nixos/modules/services/mail/nullmailer.nix    |  8 +--
 nixos/modules/services/mail/postgrey.nix      | 10 +--
 nixos/modules/services/mail/stalwart-mail.nix | 19 +++---
 nixos/modules/services/misc/autofs.nix        |  7 +-
 nixos/modules/services/misc/dictd.nix         |  2 +-
 .../modules/services/misc/docker-registry.nix |  4 +-
 nixos/modules/services/misc/errbot.nix        |  8 +--
 nixos/modules/services/misc/gollum.nix        |  8 ++-
 nixos/modules/services/misc/paperless.nix     |  9 ++-
 nixos/modules/services/misc/svnserve.nix      |  4 +-
 .../modules/services/misc/tandoor-recipes.nix | 13 ++--
 .../prometheus/exporters/pgbouncer.nix        |  4 +-
 .../modules/services/networking/dnscache.nix  |  9 +--
 .../services/networking/freeradius.nix        |  4 +-
 .../networking/ircd-hybrid/default.nix        |  2 +-
 nixos/modules/services/networking/ncps.nix    |  5 +-
 .../services/networking/nghttpx/default.nix   |  4 +-
 .../networking/nm-file-secret-agent.nix       |  2 +-
 nixos/modules/services/networking/oidentd.nix |  2 +-
 nixos/modules/services/networking/oink.nix    |  2 +-
 nixos/modules/services/networking/opengfw.nix | 29 ++++----
 .../modules/services/networking/ostinato.nix  |  4 +-
 .../modules/services/networking/pangolin.nix  | 10 +--
 nixos/modules/services/networking/pdnsd.nix   | 10 +--
 .../modules/services/networking/redsocks.nix  |  2 +-
 .../modules/services/networking/smokeping.nix |  8 +--
 nixos/modules/services/networking/supybot.nix |  6 +-
 .../modules/services/networking/tailscale.nix |  4 +-
 .../modules/services/networking/thelounge.nix |  2 +-
 nixos/modules/services/networking/tinydns.nix |  9 ++-
 nixos/modules/services/networking/toxvpn.nix  | 25 +++----
 .../modules/services/networking/twingate.nix  |  2 +-
 nixos/modules/services/networking/xinetd.nix  |  3 +-
 nixos/modules/services/networking/xray.nix    |  4 +-
 nixos/modules/services/networking/zerobin.nix |  8 +--
 nixos/modules/services/security/authelia.nix  |  2 +-
 nixos/modules/services/security/certmgr.nix   | 10 +--
 .../services/security/hologram-agent.nix      |  4 +-
 nixos/modules/services/web-apps/bluemap.nix   |  4 +-
 nixos/modules/services/web-apps/cloudlog.nix  | 21 ++----
 nixos/modules/services/web-apps/galene.nix    | 11 +--
 nixos/modules/services/web-apps/glitchtip.nix |  5 +-
 .../services/web-apps/healthchecks.nix        | 11 +--
 .../modules/services/web-apps/mediagoblin.nix | 34 +++++-----
 nixos/modules/services/web-apps/miniflux.nix  | 12 +++-
 nixos/modules/services/web-apps/misskey.nix   | 24 +++----
 nixos/modules/services/web-apps/nexus.nix     |  3 +-
 nixos/modules/services/web-apps/part-db.nix   |  5 +-
 .../services/web-apps/peering-manager.nix     |  5 +-
 .../services/web-apps/silverbullet.nix        |  4 +-
 nixos/modules/services/web-apps/wakapi.nix    |  6 +-
 .../services/web-servers/h2o/default.nix      |  3 +-
 .../services/web-servers/jboss/default.nix    |  2 +-
 nixos/tests/paperless.nix                     |  4 +-
 68 files changed, 304 insertions(+), 242 deletions(-)

diff --git a/nixos/modules/security/soteria.nix b/nixos/modules/security/soteria.nix
index 1e2b59e5714d..3b2f8349c4e5 100644
--- a/nixos/modules/security/soteria.nix
+++ b/nixos/modules/security/soteria.nix
@@ -36,8 +36,8 @@ in
       wants = [ "graphical-session.target" ];
       after = [ "graphical-session.target" ];
 
+      script = lib.getExe cfg.package;
       serviceConfig = {
-        ExecStart = lib.getExe cfg.package;
         Type = "simple";
         Restart = "on-failure";
         RestartSec = 1;
diff --git a/nixos/modules/services/blockchain/ethereum/geth.nix b/nixos/modules/services/blockchain/ethereum/geth.nix
index f58ca9d9819a..570c556ef849 100644
--- a/nixos/modules/services/blockchain/ethereum/geth.nix
+++ b/nixos/modules/services/blockchain/ethereum/geth.nix
@@ -206,43 +206,6 @@ in
           after = [ "network.target" ];
 
           serviceConfig = {
-            ExecStart =
-              let
-                args = lib.cli.toCommandLineShellGNU { } {
-                  inherit (cfg)
-                    syncmode
-                    gcmode
-                    port
-                    maxpeers
-                    ;
-                  nousb = true;
-                  ipcdisable = true;
-                  datadir = dataDir;
-                  ${cfg.network} = true;
-
-                  http = cfg.http.enable;
-                  "http.addr" = if cfg.http.enable then cfg.http.address else null;
-                  "http.port" = if cfg.http.enable then cfg.http.port else null;
-                  "http.api" = if cfg.http.apis != null then lib.concatStringsSep "," cfg.http.apis else null;
-
-                  ws = cfg.websocket.enable;
-                  "ws.addr" = if cfg.websocket.enable then cfg.websocket.address else null;
-                  "ws.port" = if cfg.websocket.enable then cfg.websocket.port else null;
-                  "ws.api" = if cfg.websocket.apis != null then lib.concatStringsSep "," cfg.websocket.apis else null;
-
-                  metrics = cfg.metrics.enable;
-                  "metrics.addr" = if cfg.metrics.enable then cfg.metrics.address else null;
-                  "metrics.port" = if cfg.metrics.enable then cfg.metrics.port else null;
-
-                  "authrpc.addr" = cfg.authrpc.address;
-                  "authrpc.port" = cfg.authrpc.port;
-                  "authrpc.vhosts" = lib.concatStringsSep "," cfg.authrpc.vhosts;
-                  "authrpc.jwtsecret" =
-                    if cfg.authrpc.jwtsecret != "" then cfg.authrpc.jwtsecret else "${dataDir}/geth/jwtsecret";
-                };
-              in
-              "${lib.getExe cfg.package} ${args} ${lib.escapeShellArgs cfg.extraArgs}";
-
             DynamicUser = true;
             Restart = "always";
             StateDirectory = stateDir;
@@ -254,6 +217,37 @@ in
             PrivateDevices = "true";
             MemoryDenyWriteExecute = "true";
           };
+
+          script = ''
+            ${cfg.package}/bin/geth \
+              --nousb \
+              --ipcdisable \
+              ${lib.optionalString (cfg.network != null) ''--${cfg.network}''} \
+              --syncmode ${cfg.syncmode} \
+              --gcmode ${cfg.gcmode} \
+              --port ${toString cfg.port} \
+              --maxpeers ${toString cfg.maxpeers} \
+              ${lib.optionalString cfg.http.enable ''--http --http.addr ${cfg.http.address} --http.port ${toString cfg.http.port}''} \
+              ${
+                lib.optionalString (cfg.http.apis != null) ''--http.api ${lib.concatStringsSep "," cfg.http.apis}''
+              } \
+              ${lib.optionalString cfg.websocket.enable ''--ws --ws.addr ${cfg.websocket.address} --ws.port ${toString cfg.websocket.port}''} \
+              ${
+                lib.optionalString (
+                  cfg.websocket.apis != null
+                ) ''--ws.api ${lib.concatStringsSep "," cfg.websocket.apis}''
+              } \
+              ${lib.optionalString cfg.metrics.enable ''--metrics --metrics.addr ${cfg.metrics.address} --metrics.port ${toString cfg.metrics.port}''} \
+              --authrpc.addr ${cfg.authrpc.address} --authrpc.port ${toString cfg.authrpc.port} --authrpc.vhosts ${lib.concatStringsSep "," cfg.authrpc.vhosts} \
+              ${
+                if (cfg.authrpc.jwtsecret != "") then
+                  ''--authrpc.jwtsecret ${cfg.authrpc.jwtsecret}''
+                else
+                  ''--authrpc.jwtsecret ${dataDir}/geth/jwtsecret''
+              } \
+              ${lib.escapeShellArgs cfg.extraArgs} \
+              --datadir ${dataDir}
+          '';
         }
       ))
     ) eachGeth;
diff --git a/nixos/modules/services/computing/boinc/client.nix b/nixos/modules/services/computing/boinc/client.nix
index a0d244337be8..8467e4b297c1 100644
--- a/nixos/modules/services/computing/boinc/client.nix
+++ b/nixos/modules/services/computing/boinc/client.nix
@@ -99,8 +99,10 @@ in
       description = "BOINC Client";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      script = ''
+        exec ${fhsEnvExecutable} --dir ${cfg.dataDir} ${allowRemoteGuiRpcFlag}
+      '';
       serviceConfig = {
-        ExecStart = "${fhsEnvExecutable} --dir ${cfg.dataDir} ${allowRemoteGuiRpcFlag}";
         User = "boinc";
         Nice = 10;
       };
diff --git a/nixos/modules/services/computing/slurm/slurm.nix b/nixos/modules/services/computing/slurm/slurm.nix
index 989053da173b..4d01d4533f67 100644
--- a/nixos/modules/services/computing/slurm/slurm.nix
+++ b/nixos/modules/services/computing/slurm/slurm.nix
@@ -475,13 +475,15 @@ in
             ''}
           '';
 
-          environment.SLURM_CONF = configPath;
+          script = ''
+            export SLURM_CONF=${configPath}
+            exec ${cfg.package}/bin/slurmdbd -D
+          '';
 
           serviceConfig = {
             RuntimeDirectory = "slurmdbd";
             Type = "simple";
             PIDFile = "/run/slurmdbd.pid";
-            ExecStart = "${lib.getExe' cfg.package "slurmdbd"} -D";
             ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           };
         };
diff --git a/nixos/modules/services/games/minetest-server.nix b/nixos/modules/services/games/minetest-server.nix
index 49b0f88d9674..d1718d3bca9d 100644
--- a/nixos/modules/services/games/minetest-server.nix
+++ b/nixos/modules/services/games/minetest-server.nix
@@ -172,9 +172,12 @@ in
       serviceConfig.Restart = "always";
       serviceConfig.User = "minetest";
       serviceConfig.Group = "minetest";
-      serviceConfig.StateDirectory = "minetest";
-      serviceConfig.WorkingDirectory = "/var/lib/minetest";
-      serviceConfig.ExecStart = "${pkgs.minetest}/bin/minetest ${lib.escapeShellArgs flags}";
+
+      script = ''
+        cd /var/lib/minetest
+
+        exec ${pkgs.minetest}/bin/minetest ${lib.escapeShellArgs flags}
+      '';
     };
   };
 }
diff --git a/nixos/modules/services/hardware/pommed.nix b/nixos/modules/services/hardware/pommed.nix
index ba627c009efd..3bb53ce4603a 100644
--- a/nixos/modules/services/hardware/pommed.nix
+++ b/nixos/modules/services/hardware/pommed.nix
@@ -51,7 +51,7 @@ in
     systemd.services.pommed = {
       description = "Pommed Apple Hotkeys Daemon";
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${lib.getExe pkgs.pommed_light} -f";
+      script = "${pkgs.pommed_light}/bin/pommed -f";
     };
   };
 }
diff --git a/nixos/modules/services/home-automation/zigbee2mqtt.nix b/nixos/modules/services/home-automation/zigbee2mqtt.nix
index 0bf3a636c18e..d02cc7484991 100644
--- a/nixos/modules/services/home-automation/zigbee2mqtt.nix
+++ b/nixos/modules/services/home-automation/zigbee2mqtt.nix
@@ -79,7 +79,6 @@ in
       after = [ "network.target" ];
       environment.ZIGBEE2MQTT_DATA = cfg.dataDir;
       serviceConfig = {
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "cp"} --no-preserve=mode ${configFile} '${cfg.dataDir}/configuration.yaml'";
         ExecStart = "${cfg.package}/bin/zigbee2mqtt";
         User = "zigbee2mqtt";
         Group = "zigbee2mqtt";
@@ -130,6 +129,9 @@ in
         ];
         UMask = "0077";
       };
+      preStart = ''
+        cp --no-preserve=mode ${configFile} "${cfg.dataDir}/configuration.yaml"
+      '';
     };
 
     users.users.zigbee2mqtt = {
diff --git a/nixos/modules/services/logging/heartbeat.nix b/nixos/modules/services/logging/heartbeat.nix
index 8cc99e84c9bf..2280c4349144 100644
--- a/nixos/modules/services/logging/heartbeat.nix
+++ b/nixos/modules/services/logging/heartbeat.nix
@@ -67,10 +67,12 @@ in
     systemd.services.heartbeat = {
       description = "heartbeat log shipper";
       wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -p "${cfg.stateDir}"/{data,logs}
+      '';
       serviceConfig = {
         User = "nobody";
         AmbientCapabilities = "cap_net_raw";
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.stateDir}'/data '${cfg.stateDir}'/logs";
         ExecStart = "${cfg.package}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\"";
       };
     };
diff --git a/nixos/modules/services/logging/journalbeat.nix b/nixos/modules/services/logging/journalbeat.nix
index acd178234ab7..af178a3838d2 100644
--- a/nixos/modules/services/logging/journalbeat.nix
+++ b/nixos/modules/services/logging/journalbeat.nix
@@ -71,12 +71,12 @@ in
       wantedBy = [ "multi-user.target" ];
       wants = [ "elasticsearch.service" ];
       after = [ "elasticsearch.service" ];
+      preStart = ''
+        mkdir -p ${cfg.stateDir}/data
+        mkdir -p ${cfg.stateDir}/logs
+      '';
       serviceConfig = {
         StateDirectory = cfg.stateDir;
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.stateDir}/data"
-          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.stateDir}/logs"
-        ];
         ExecStart = ''
           ${cfg.package}/bin/journalbeat \
             -c ${journalbeatYml} \
diff --git a/nixos/modules/services/logging/journaldriver.nix b/nixos/modules/services/logging/journaldriver.nix
index d9f0ccd39d97..efb53de0b484 100644
--- a/nixos/modules/services/logging/journaldriver.nix
+++ b/nixos/modules/services/logging/journaldriver.nix
@@ -91,12 +91,12 @@ in
   config = mkIf cfg.enable {
     systemd.services.journaldriver = {
       description = "Stackdriver Logging journal forwarder";
+      script = "${pkgs.journaldriver}/bin/journaldriver";
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = lib.getExe pkgs.journaldriver;
         Restart = "always";
         DynamicUser = true;
 
diff --git a/nixos/modules/services/logging/promtail.nix b/nixos/modules/services/logging/promtail.nix
index 4bf59a783df1..f346070441b3 100644
--- a/nixos/modules/services/logging/promtail.nix
+++ b/nixos/modules/services/logging/promtail.nix
@@ -66,11 +66,14 @@ in
       wantedBy = [ "multi-user.target" ];
       stopIfChanged = false;
 
+      preStart = ''
+        ${lib.getExe pkgs.promtail} -config.file=${configFile} -check-syntax
+      '';
+
       serviceConfig = {
         Restart = "on-failure";
         TimeoutStopSec = 10;
 
-        ExecStartPre = "${lib.getExe pkgs.promtail} -config.file=${configFile} -check-syntax";
         ExecStart = "${pkgs.promtail}/bin/promtail -config.file=${configFile} ${escapeShellArgs cfg.extraFlags}";
 
         ProtectSystem = "strict";
diff --git a/nixos/modules/services/logging/syslog-ng.nix b/nixos/modules/services/logging/syslog-ng.nix
index 6b3e7c3e599d..4c04d1f1f5dd 100644
--- a/nixos/modules/services/logging/syslog-ng.nix
+++ b/nixos/modules/services/logging/syslog-ng.nix
@@ -79,6 +79,7 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.syslog-ng = {
       description = "syslog-ng daemon";
+      preStart = "mkdir -p /{var,run}/syslog-ng";
       wantedBy = [ "multi-user.target" ];
       after = [ "multi-user.target" ]; # makes sure hostname etc is set
       serviceConfig = {
@@ -86,7 +87,6 @@ in
         PIDFile = pidFile;
         StandardOutput = "null";
         Restart = "on-failure";
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p /var/syslog-ng /run/syslog-ng";
         ExecStart = "${cfg.package}/sbin/syslog-ng ${lib.concatStringsSep " " syslogngOptions}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
       };
diff --git a/nixos/modules/services/mail/cyrus-imap.nix b/nixos/modules/services/mail/cyrus-imap.nix
index dc67ccaaad66..9ee7cf8ee44b 100644
--- a/nixos/modules/services/mail/cyrus-imap.nix
+++ b/nixos/modules/services/mail/cyrus-imap.nix
@@ -342,7 +342,6 @@ in
         User = if (cfg.user == null) then "cyrus" else cfg.user;
         Group = if (cfg.group == null) then "cyrus" else cfg.group;
         Type = "simple";
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.imapdSettings.configdirectory}/socket' '${cfg.tmpDBDir}' /run/cyrus/proc /run/cyrus/lock";
         ExecStart = "${cyrus-imapdPkg}/libexec/master -l $LISTENQUEUE -C /etc/imapd.conf -M /etc/cyrus.conf -p /run/cyrus/master.pid -D";
         Restart = "on-failure";
         RestartSec = "1s";
@@ -368,6 +367,9 @@ in
         RestrictNamespaces = true;
         RestrictRealtime = true;
       };
+      preStart = ''
+        mkdir -p '${cfg.imapdSettings.configdirectory}/socket' '${cfg.tmpDBDir}' /run/cyrus/proc /run/cyrus/lock
+      '';
     };
     environment.systemPackages = [ cyrus-imapdPkg ];
   };
diff --git a/nixos/modules/services/mail/dkimproxy-out.nix b/nixos/modules/services/mail/dkimproxy-out.nix
index 168bbdd5a1a9..2fefcd6b68a2 100644
--- a/nixos/modules/services/mail/dkimproxy-out.nix
+++ b/nixos/modules/services/mail/dkimproxy-out.nix
@@ -109,8 +109,10 @@ in
             chown -R dkimproxy-out:dkimproxy-out "${keydir}"
           fi
         '';
+        script = ''
+          exec ${pkgs.dkimproxy}/bin/dkimproxy.out --conf_file=${configfile}
+        '';
         serviceConfig = {
-          ExecStart = "${pkgs.dkimproxy}/bin/dkimproxy.out --conf_file=${configfile}";
           User = "dkimproxy-out";
           PermissionsStartOnly = true;
         };
diff --git a/nixos/modules/services/mail/nullmailer.nix b/nixos/modules/services/mail/nullmailer.nix
index a8b1cf76f351..6dc278f89f29 100644
--- a/nixos/modules/services/mail/nullmailer.nix
+++ b/nixos/modules/services/mail/nullmailer.nix
@@ -245,13 +245,13 @@
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
 
+        preStart = ''
+          rm -f /var/spool/nullmailer/trigger && mkfifo -m 660 /var/spool/nullmailer/trigger
+        '';
+
         serviceConfig = {
           User = cfg.user;
           Group = cfg.group;
-          ExecStartPre = [
-            "${lib.getExe' pkgs.coreutils "rm"} -f /var/spool/nullmailer/trigger"
-            "${lib.getExe' pkgs.coreutils "mkfifo"} -m 660 /var/spool/nullmailer/trigger"
-          ];
           ExecStart = "${pkgs.nullmailer}/bin/nullmailer-send";
           Restart = "always";
         };
diff --git a/nixos/modules/services/mail/postgrey.nix b/nixos/modules/services/mail/postgrey.nix
index 67a97f6a244f..463757fa8440 100644
--- a/nixos/modules/services/mail/postgrey.nix
+++ b/nixos/modules/services/mail/postgrey.nix
@@ -210,13 +210,13 @@ in
         description = "Postfix Greylisting Service";
         wantedBy = [ "multi-user.target" ];
         before = [ "postfix.service" ];
+        preStart = ''
+          mkdir -p /var/postgrey
+          chown postgrey:postgrey /var/postgrey
+          chmod 0770 /var/postgrey
+        '';
         serviceConfig = {
           Type = "simple";
-          ExecStartPre = [
-            "${lib.getExe' pkgs.coreutils "mkdir"} -p /var/postgrey"
-            "${lib.getExe' pkgs.coreutils "chown"} postgrey:postgrey /var/postgrey"
-            "${lib.getExe' pkgs.coreutils "chmod"} 0770 /var/postgrey"
-          ];
           ExecStart = ''
             ${pkgs.postgrey}/bin/postgrey \
                       ${bind-flag} \
diff --git a/nixos/modules/services/mail/stalwart-mail.nix b/nixos/modules/services/mail/stalwart-mail.nix
index 3c1fc27e45f8..34004da62ef7 100644
--- a/nixos/modules/services/mail/stalwart-mail.nix
+++ b/nixos/modules/services/mail/stalwart-mail.nix
@@ -162,16 +162,17 @@ in
           "network.target"
         ];
 
+        preStart =
+          if useLegacyStorage then
+            ''
+              mkdir -p ${cfg.dataDir}/data/blobs
+            ''
+          else
+            ''
+              mkdir -p ${cfg.dataDir}/db
+            '';
+
         serviceConfig = {
-          ExecStartPre =
-            if useLegacyStorage then
-              ''
-                ${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/data/blobs
-              ''
-            else
-              ''
-                ${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/db
-              '';
           ExecStart = [
             ""
             "${lib.getExe cfg.package} --config=${configFile}"
diff --git a/nixos/modules/services/misc/autofs.nix b/nixos/modules/services/misc/autofs.nix
index edfefac1fdf2..e258fb20b7ea 100644
--- a/nixos/modules/services/misc/autofs.nix
+++ b/nixos/modules/services/misc/autofs.nix
@@ -88,11 +88,14 @@ in
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        # There should be only one autofs service managed by systemd, so this should be safe.
+        rm -f /tmp/autofs-running
+      '';
+
       serviceConfig = {
         Type = "forking";
         PIDFile = "/run/autofs.pid";
-        # There should be only one autofs service managed by systemd, so this should be safe.
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "rm"} -f /tmp/autofs-running";
         ExecStart = "${pkgs.autofs5}/bin/automount ${lib.optionalString cfg.debug "-d"} -p /run/autofs.pid -t ${builtins.toString cfg.timeout} ${autoMaster}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
       };
diff --git a/nixos/modules/services/misc/dictd.nix b/nixos/modules/services/misc/dictd.nix
index 3de6ccb1896e..b216459b2d9b 100644
--- a/nixos/modules/services/misc/dictd.nix
+++ b/nixos/modules/services/misc/dictd.nix
@@ -78,7 +78,7 @@ in
         # with code 143 instead of exiting with code 0.
         serviceConfig.SuccessExitStatus = [ 143 ];
         serviceConfig.Type = "forking";
-        serviceConfig.ExecStart = "${pkgs.dict}/sbin/dictd -s -c ${dictdb}/share/dictd/dictd.conf --locale en_US.UTF-8";
+        script = "${pkgs.dict}/sbin/dictd -s -c ${dictdb}/share/dictd/dictd.conf --locale en_US.UTF-8";
       };
     };
 }
diff --git a/nixos/modules/services/misc/docker-registry.nix b/nixos/modules/services/misc/docker-registry.nix
index ea364d68c36a..f4abe2c8bf86 100644
--- a/nixos/modules/services/misc/docker-registry.nix
+++ b/nixos/modules/services/misc/docker-registry.nix
@@ -143,9 +143,11 @@ in
       description = "Docker Container Registry";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+      script = ''
+        ${cfg.package}/bin/registry serve ${configFile}
+      '';
 
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} serve ${configFile}";
         User = "docker-registry";
         WorkingDirectory = cfg.storagePath;
         AmbientCapabilities = lib.mkIf (cfg.port < 1024) "cap_net_bind_service";
diff --git a/nixos/modules/services/misc/errbot.nix b/nixos/modules/services/misc/errbot.nix
index aa94368d61d2..d9f52af7fe72 100644
--- a/nixos/modules/services/misc/errbot.nix
+++ b/nixos/modules/services/misc/errbot.nix
@@ -100,13 +100,13 @@ in
         {
           after = [ "network-online.target" ];
           wantedBy = [ "multi-user.target" ];
+          preStart = ''
+            mkdir -p ${dataDir}
+            chown -R errbot:errbot ${dataDir}
+          '';
           serviceConfig = {
             User = "errbot";
             Restart = "on-failure";
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${dataDir}"
-              "${lib.getExe' pkgs.coreutils "chown"} -R errbot:errbot ${dataDir}"
-            ];
             ExecStart = "${pkgs.errbot}/bin/errbot -c ${mkConfigDir instanceCfg dataDir}/config.py";
             PermissionsStartOnly = true;
           };
diff --git a/nixos/modules/services/misc/gollum.nix b/nixos/modules/services/misc/gollum.nix
index a6793362d188..ccfa63d3823d 100644
--- a/nixos/modules/services/misc/gollum.nix
+++ b/nixos/modules/services/misc/gollum.nix
@@ -138,13 +138,17 @@ in
       description = "Gollum wiki";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.git ];
+
+      preStart = ''
+        # This is safe to be run on an existing repo
+        git init ${cfg.stateDir}
+      '';
 
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.stateDir;
-        # This is safe to be run on an existing repo
-        ExecStartPre = "${lib.getExe pkgs.git} init ${cfg.stateDir}";
         ExecStart = ''
           ${cfg.package}/bin/gollum \
             --port ${toString cfg.port} \
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 04759856ac7a..14bb792790a7 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -664,9 +664,6 @@ in
           serviceConfig = {
             User = cfg.user;
             WorkingDirectory = cfg.dataDir;
-            ExecStart = "${manage}/bin/paperless-manage document_exporter ${cfg.exporter.directory} ${
-              lib.cli.toCommandLineShellGNU { } cfg.exporter.settings
-            }";
           };
           unitConfig =
             let
@@ -685,7 +682,13 @@ in
               OnFailure = services;
               OnSuccess = services;
             };
+          enableStrictShellChecks = true;
           path = [ manage ];
+          script = ''
+            paperless-manage document_exporter ${cfg.exporter.directory} ${
+              lib.cli.toCommandLineShellGNU { } cfg.exporter.settings
+            }
+          '';
         };
       })
     ]
diff --git a/nixos/modules/services/misc/svnserve.nix b/nixos/modules/services/misc/svnserve.nix
index 716eed8d35cd..b72e6186c1cd 100644
--- a/nixos/modules/services/misc/svnserve.nix
+++ b/nixos/modules/services/misc/svnserve.nix
@@ -40,8 +40,8 @@ in
     systemd.services.svnserve = {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      services.ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.svnBaseDir}";
-      services.ExecStart = "${pkgs.subversion.out}/bin/svnserve -r ${cfg.svnBaseDir} -d --foreground --pid-file=/run/svnserve.pid";
+      preStart = "mkdir -p ${cfg.svnBaseDir}";
+      script = "${pkgs.subversion.out}/bin/svnserve -r ${cfg.svnBaseDir} -d --foreground --pid-file=/run/svnserve.pid";
     };
   };
 }
diff --git a/nixos/modules/services/misc/tandoor-recipes.nix b/nixos/modules/services/misc/tandoor-recipes.nix
index 10d28c390a38..549b3ad5fa3d 100644
--- a/nixos/modules/services/misc/tandoor-recipes.nix
+++ b/nixos/modules/services/misc/tandoor-recipes.nix
@@ -119,12 +119,6 @@ in
       after = lib.optional cfg.database.createLocally "postgresql.target";
 
       serviceConfig = {
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "ln"} -sf ${manage} tandoor-recipes-manage"
-
-          # Let django migrate the DB as needed
-          "${lib.getExe pkg} migrate"
-        ];
         ExecStart = ''
           ${pkg.python.pkgs.gunicorn}/bin/gunicorn recipes.wsgi
         '';
@@ -178,6 +172,13 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        ln -sf ${manage} tandoor-recipes-manage
+
+        # Let django migrate the DB as needed
+        ${pkg}/bin/tandoor-recipes migrate
+      '';
+
       environment = env // {
         PYTHONPATH = "${pkg.python.pkgs.makePythonPath pkg.propagatedBuildInputs}:${pkg}/lib/tandoor-recipes";
       };
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix b/nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix
index 380f49fbba01..4b9cc658bf4a 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/pgbouncer.nix
@@ -139,9 +139,9 @@ in
 
   serviceOpts = {
     after = [ "pgbouncer.service" ];
-    serviceConfig.ExecStart = concatStringsSep " " (
+    script = concatStringsSep " " (
       [
-        "${escapeShellArg (getExe cfg.package)}"
+        "exec -- ${escapeShellArg (getExe cfg.package)}"
         "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
       ]
       ++ optionals (cfg.connectionString != null) [
diff --git a/nixos/modules/services/networking/dnscache.nix b/nixos/modules/services/networking/dnscache.nix
index 938033a8583f..f360aa86c7b8 100644
--- a/nixos/modules/services/networking/dnscache.nix
+++ b/nixos/modules/services/networking/dnscache.nix
@@ -108,16 +108,17 @@ in
         daemontools
         djbdns
       ];
-      environment.FORWARDONLY = lib.mkIf cfg.forwardOnly "1";
       preStart = ''
         rm -rf /var/lib/dnscache
         dnscache-conf dnscache dnscache /var/lib/dnscache ${config.services.dnscache.ip}
         rm -rf /var/lib/dnscache/root
         ln -sf ${dnscache-root} /var/lib/dnscache/root
       '';
-      serviceConfig.StateDirectory = "dnscache";
-      serviceConfig.WorkingDirectory = "/var/lib/dnscache";
-      serviceConfig.ExecStart = "/var/lib/dnscache/run";
+      script = ''
+        cd /var/lib/dnscache/
+        ${lib.optionalString cfg.forwardOnly "export FORWARDONLY=1"}
+        exec ./run
+      '';
     };
   };
 }
diff --git a/nixos/modules/services/networking/freeradius.nix b/nixos/modules/services/networking/freeradius.nix
index 569734f6d70b..cd766f919579 100644
--- a/nixos/modules/services/networking/freeradius.nix
+++ b/nixos/modules/services/networking/freeradius.nix
@@ -13,9 +13,11 @@ let
     wantedBy = [ "multi-user.target" ];
     after = [ "network.target" ];
     wants = [ "network.target" ];
+    preStart = ''
+      ${cfg.package}/bin/radiusd -C -d ${cfg.configDir} -l stdout
+    '';
 
     serviceConfig = {
-      ExecStartPre = "${cfg.package}/bin/radiusd -C -d ${cfg.configDir} -l stdout";
       ExecStart =
         "${cfg.package}/bin/radiusd -f -d ${cfg.configDir} -l stdout" + lib.optionalString cfg.debug " -xx";
       ExecReload = [
diff --git a/nixos/modules/services/networking/ircd-hybrid/default.nix b/nixos/modules/services/networking/ircd-hybrid/default.nix
index 1504a93d9203..95e19636edaf 100644
--- a/nixos/modules/services/networking/ircd-hybrid/default.nix
+++ b/nixos/modules/services/networking/ircd-hybrid/default.nix
@@ -152,7 +152,7 @@ in
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${ircdService}/bin/control start";
+      script = "${ircdService}/bin/control start";
     };
   };
 }
diff --git a/nixos/modules/services/networking/ncps.nix b/nixos/modules/services/networking/ncps.nix
index 4a938f50652e..ebc3af2cec0f 100644
--- a/nixos/modules/services/networking/ncps.nix
+++ b/nixos/modules/services/networking/ncps.nix
@@ -275,9 +275,12 @@ in
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        ${lib.getExe cfg.dbmatePackage} --migrations-dir=${cfg.package}/share/ncps/db/migrations --url=${cfg.cache.databaseURL} up
+      '';
+
       serviceConfig = lib.mkMerge [
         {
-          ExecStartPre = "${lib.getExe cfg.dbmatePackage} --migrations-dir=${cfg.package}/share/ncps/db/migrations --url=${cfg.cache.databaseURL} up";
           ExecStart = "${lib.getExe cfg.package} ${globalFlags} serve ${serveFlags}";
           User = "ncps";
           Group = "ncps";
diff --git a/nixos/modules/services/networking/nghttpx/default.nix b/nixos/modules/services/networking/nghttpx/default.nix
index a9ae12ac6c62..40eba4849adc 100644
--- a/nixos/modules/services/networking/nghttpx/default.nix
+++ b/nixos/modules/services/networking/nghttpx/default.nix
@@ -115,9 +115,11 @@ in
       nghttpx = {
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
+        script = ''
+          ${pkgs.nghttp2}/bin/nghttpx --conf=${configurationFile}
+        '';
 
         serviceConfig = {
-          ExecStart = "${pkgs.nghttp2}/bin/nghttpx --conf=${configurationFile}";
           Restart = "on-failure";
           RestartSec = 60;
         };
diff --git a/nixos/modules/services/networking/nm-file-secret-agent.nix b/nixos/modules/services/networking/nm-file-secret-agent.nix
index 4a1a36244cca..669a6e208deb 100644
--- a/nixos/modules/services/networking/nm-file-secret-agent.nix
+++ b/nixos/modules/services/networking/nm-file-secret-agent.nix
@@ -125,7 +125,7 @@ in
       after = [ "NetworkManager.service" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ nmFileSecretAgentConfigFile ];
-      serviceConfig.ExecStart = "${lib.getExe cfg.ensureProfiles.secrets.package} --conf ${nmFileSecretAgentConfigFile}";
+      script = "${lib.getExe cfg.ensureProfiles.secrets.package} --conf ${nmFileSecretAgentConfigFile}";
     };
   };
 }
diff --git a/nixos/modules/services/networking/oidentd.nix b/nixos/modules/services/networking/oidentd.nix
index e3c38cf2dfd6..159da0913995 100644
--- a/nixos/modules/services/networking/oidentd.nix
+++ b/nixos/modules/services/networking/oidentd.nix
@@ -32,7 +32,7 @@ with lib;
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig.Type = "forking";
-      serviceConfig.ExecStart = "${lib.getExe pkgs.oidentd} -u oidentd -g nogroup";
+      script = "${pkgs.oidentd}/sbin/oidentd -u oidentd -g nogroup";
     };
 
     users.users.oidentd = {
diff --git a/nixos/modules/services/networking/oink.nix b/nixos/modules/services/networking/oink.nix
index bc255ffc6ba9..5c76a7de5036 100644
--- a/nixos/modules/services/networking/oink.nix
+++ b/nixos/modules/services/networking/oink.nix
@@ -84,8 +84,8 @@ in
       description = "Dynamic DNS client for Porkbun";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      script = "${cfg.package}/bin/oink -c ${oinkConfig}";
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} -c ${oinkConfig}";
         Restart = "on-failure";
         RestartSec = "10";
       };
diff --git a/nixos/modules/services/networking/opengfw.nix b/nixos/modules/services/networking/opengfw.nix
index 38678156fd03..4b92a230842d 100644
--- a/nixos/modules/services/networking/opengfw.nix
+++ b/nixos/modules/services/networking/opengfw.nix
@@ -374,22 +374,21 @@ in
         after = [ "network.target" ];
         path = with pkgs; [ iptables ];
 
+        preStart = ''
+          ${optionalString (rules != null) "ln -sf ${rules} rules.yaml"}
+          ${optionalString (settings != null) "ln -sf ${settings} config.yaml"}
+        '';
+
+        script = ''
+          ${config.security.wrapperDir}/OpenGFW \
+            -f ${cfg.logFormat} \
+            -l ${cfg.logLevel} \
+            ${optionalString (cfg.pcapReplay != null) "-p ${cfg.pcapReplay}"} \
+            -c config.yaml \
+            rules.yaml
+        '';
+
         serviceConfig = rec {
-          ExecStartPre =
-            lib.optionals (rules != null) [ "${lib.getExe' pkgs.coreutils "ln"} -sf ${rules} rules.yaml" ]
-            ++ lib.optionals (settings != null) [
-              "${lib.getExe' pkgs.coreutils "ln"} -sf ${settings} config.yaml"
-            ];
-          ExecStart =
-            let
-              args = lib.cli.toCommandLineShellGNU { } {
-                f = cfg.logFormat;
-                l = cfg.logLevel;
-                p = cfg.pcapReplay;
-                c = "config.yaml";
-              };
-            in
-            "${config.security.wrapperDir}/OpenGFW ${args} rules.yaml";
           WorkingDirectory = cfg.dir;
           ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
           Restart = "always";
diff --git a/nixos/modules/services/networking/ostinato.nix b/nixos/modules/services/networking/ostinato.nix
index 9006a8b97e7b..cfe7f934bf36 100644
--- a/nixos/modules/services/networking/ostinato.nix
+++ b/nixos/modules/services/networking/ostinato.nix
@@ -108,7 +108,9 @@ in
     systemd.services.drone = {
       description = "Ostinato agent-controller";
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkg}/bin/drone ${toString cfg.port} ${configFile}";
+      script = ''
+        ${pkg}/bin/drone ${toString cfg.port} ${configFile}
+      '';
     };
 
   };
diff --git a/nixos/modules/services/networking/pangolin.nix b/nixos/modules/services/networking/pangolin.nix
index ee7d1458ed70..9b5bdb9d3690 100644
--- a/nixos/modules/services/networking/pangolin.nix
+++ b/nixos/modules/services/networking/pangolin.nix
@@ -241,6 +241,11 @@ in
           requires = [ "network.target" ];
           after = [ "network.target" ];
 
+          preStart = ''
+            mkdir -p ${cfg.dataDir}/config
+            cp -f ${cfgFile} ${cfg.dataDir}/config/config.yml
+          '';
+
           serviceConfig = {
             User = "pangolin";
             Group = "fossorial";
@@ -312,11 +317,6 @@ in
               "~@swap:EPERM"
               "~@timer:EPERM"
             ];
-
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/config"
-              "${lib.getExe' pkgs.coreutils "cp"} -f ${cfgFile} ${cfg.dataDir}/config/config.yml"
-            ];
             ExecStart = lib.getExe cfg.package;
           };
         };
diff --git a/nixos/modules/services/networking/pdnsd.nix b/nixos/modules/services/networking/pdnsd.nix
index abc78b5d569b..cda55cc2a7e8 100644
--- a/nixos/modules/services/networking/pdnsd.nix
+++ b/nixos/modules/services/networking/pdnsd.nix
@@ -80,13 +80,13 @@ in
     systemd.services.pdnsd = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+      preStart = ''
+        mkdir -p "${cfg.cacheDir}"
+        touch "${cfg.cacheDir}/pdnsd.cache"
+        chown -R ${pdnsdUser}:${pdnsdGroup} "${cfg.cacheDir}"
+      '';
       description = "pdnsd";
       serviceConfig = {
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.cacheDir}'"
-          "${lib.getExe' pkgs.coreutils "touch"} '${cfg.cacheDir}/pdnsd.cache'"
-          "${lib.getExe' pkgs.coreutils "chown"} -R ${pdnsdUser}:${pdnsdGroup} '${cfg.cacheDir}'"
-        ];
         ExecStart = "${pdnsd}/bin/pdnsd -c ${pdnsdConf}";
       };
     };
diff --git a/nixos/modules/services/networking/redsocks.nix b/nixos/modules/services/networking/redsocks.nix
index 1c4ef08fdc7f..852dcc8ff431 100644
--- a/nixos/modules/services/networking/redsocks.nix
+++ b/nixos/modules/services/networking/redsocks.nix
@@ -276,7 +276,7 @@ in
         description = "Redsocks";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = "${lib.getExe pkgs.redsocks} -c ${configfile}";
+        script = "${pkgs.redsocks}/bin/redsocks -c ${configfile}";
       };
 
       networking.firewall.extraCommands = iptables;
diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix
index 5990c0d4fa2e..d15f8689dd73 100644
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@@ -337,12 +337,12 @@ in
       serviceConfig = {
         User = cfg.user;
         Restart = "on-failure";
-        ExecStartPre = [
-          "${cfg.package}/bin/smokeping --check --config=${configPath}"
-          "${cfg.package}/bin/smokeping --static --config=${configPath}"
-        ];
         ExecStart = "${cfg.package}/bin/smokeping --config=/etc/smokeping.conf --nodaemon";
       };
+      preStart = ''
+        ${cfg.package}/bin/smokeping --check --config=${configPath}
+        ${cfg.package}/bin/smokeping --static --config=${configPath}
+      '';
     };
 
     systemd.tmpfiles.rules = [
diff --git a/nixos/modules/services/networking/supybot.nix b/nixos/modules/services/networking/supybot.nix
index 6a9d64a97cc2..f05e1fe30112 100644
--- a/nixos/modules/services/networking/supybot.nix
+++ b/nixos/modules/services/networking/supybot.nix
@@ -104,12 +104,14 @@ in
       documentation = [ "https://limnoria.readthedocs.io/" ];
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        # This needs to be created afresh every time
+        rm -f '${cfg.stateDir}/supybot.cfg.bak'
+      '';
 
       startLimitIntervalSec = 5 * 60; # 5 min
       startLimitBurst = 1;
       serviceConfig = {
-        # This needs to be created afresh every time
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "rm"} -f '${cfg.stateDir}/supybot.cfg.bak'";
         ExecStart = "${pyEnv}/bin/supybot ${cfg.stateDir}/supybot.cfg";
         PIDFile = "/run/supybot.pid";
         User = "supybot";
diff --git a/nixos/modules/services/networking/tailscale.nix b/nixos/modules/services/networking/tailscale.nix
index b673d29bb40e..0b6e110d2caa 100644
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@@ -240,8 +240,10 @@ in
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${lib.getExe cfg.package} set ${escapeShellArgs cfg.extraSetFlags}";
       };
+      script = ''
+        ${lib.getExe cfg.package} set ${escapeShellArgs cfg.extraSetFlags}
+      '';
     };
 
     boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") {
diff --git a/nixos/modules/services/networking/thelounge.nix b/nixos/modules/services/networking/thelounge.nix
index 4a3ef4d1c426..a8104c2e1b88 100644
--- a/nixos/modules/services/networking/thelounge.nix
+++ b/nixos/modules/services/networking/thelounge.nix
@@ -112,11 +112,11 @@ in
     systemd.services.thelounge = {
       description = "The Lounge web IRC client";
       wantedBy = [ "multi-user.target" ];
+      preStart = "ln -sf ${pkgs.writeText "config.js" configJsData} ${dataDir}/config.js";
       environment.THELOUNGE_PACKAGES = mkIf (cfg.plugins != [ ]) "${plugins}";
       serviceConfig = {
         User = "thelounge";
         StateDirectory = baseNameOf dataDir;
-        ExecStartPre = "${lib.getExe' pkgs.coreutils "ln"} -sf ${pkgs.writeText "config.js" configJsData} ${dataDir}/config.js";
         ExecStart = "${getExe cfg.package} start";
       };
     };
diff --git a/nixos/modules/services/networking/tinydns.nix b/nixos/modules/services/networking/tinydns.nix
index 709f751ee825..145357b828b1 100644
--- a/nixos/modules/services/networking/tinydns.nix
+++ b/nixos/modules/services/networking/tinydns.nix
@@ -58,11 +58,10 @@ with lib;
         ln -sf ${pkgs.writeText "tinydns-data" config.services.tinydns.data} data
         tinydns-data
       '';
-      serviceConfig = {
-        StateDirectory = "tinydns";
-        WorkingDirectory = "/var/lib/tinydns";
-        ExecStart = "/var/lib/tinydns/run";
-      };
+      script = ''
+        cd /var/lib/tinydns
+        exec ./run
+      '';
     };
   };
 }
diff --git a/nixos/modules/services/networking/toxvpn.nix b/nixos/modules/services/networking/toxvpn.nix
index 4688e410cee4..112c86187666 100644
--- a/nixos/modules/services/networking/toxvpn.nix
+++ b/nixos/modules/services/networking/toxvpn.nix
@@ -43,19 +43,20 @@ with lib;
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
+      preStart = ''
+        mkdir -p /run/toxvpn || true
+        chown toxvpn /run/toxvpn
+      '';
+
+      path = [ pkgs.toxvpn ];
+
+      script = ''
+        exec toxvpn -i ${config.services.toxvpn.localip} -l /run/toxvpn/control -u toxvpn -p ${toString config.services.toxvpn.port} ${
+          lib.concatMapStringsSep " " (x: "-a ${x}") config.services.toxvpn.auto_add_peers
+        }
+      '';
+
       serviceConfig = {
-        ExecStart =
-          let
-            args = lib.cli.toCommandLineShellGNU { } {
-              i = config.services.toxvpn.localip;
-              l = "/run/toxvpn/control";
-              u = "toxvpn";
-              p = config.services.toxvpn.port;
-              a = config.services.toxvpn.auto_add_peers;
-            };
-          in
-          "${lib.getExe pkgs.toxvpn} ${args}";
-        RuntimeDirectory = "toxvpn";
         KillMode = "process";
         Restart = "on-success";
         Type = "notify";
diff --git a/nixos/modules/services/networking/twingate.nix b/nixos/modules/services/networking/twingate.nix
index 14baae06bc89..4e9edf6bb23d 100644
--- a/nixos/modules/services/networking/twingate.nix
+++ b/nixos/modules/services/networking/twingate.nix
@@ -17,7 +17,7 @@ in
   config = lib.mkIf cfg.enable {
     systemd.packages = [ cfg.package ];
     systemd.services.twingate = {
-      serviceConfig.ExecStartPre = "${lib.getExe' pkgs.coreutils "cp"} -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
+      preStart = "cp -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
       wantedBy = [ "multi-user.target" ];
     };
 
diff --git a/nixos/modules/services/networking/xinetd.nix b/nixos/modules/services/networking/xinetd.nix
index f1be424e075a..d33b4d97519b 100644
--- a/nixos/modules/services/networking/xinetd.nix
+++ b/nixos/modules/services/networking/xinetd.nix
@@ -143,7 +143,8 @@ in
       description = "xinetd server";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${lib.getExe pkgs.xinetd} -syslog daemon -dontfork -stayalive -f ${configFile}";
+      path = [ pkgs.xinetd ];
+      script = "exec xinetd -syslog daemon -dontfork -stayalive -f ${configFile}";
     };
   };
 }
diff --git a/nixos/modules/services/networking/xray.nix b/nixos/modules/services/networking/xray.nix
index fc638f7ce766..1d0d514d2e48 100644
--- a/nixos/modules/services/networking/xray.nix
+++ b/nixos/modules/services/networking/xray.nix
@@ -93,8 +93,10 @@ with lib;
         description = "xray Daemon";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
+        script = ''
+          exec "${cfg.package}/bin/xray" -config "$CREDENTIALS_DIRECTORY/config.json"
+        '';
         serviceConfig = {
-          ExecStart = "${cfg.package}/bin/xray -config %d/config.json";
           DynamicUser = true;
           LoadCredential = "config.json:${settingsFile}";
           CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
diff --git a/nixos/modules/services/networking/zerobin.nix b/nixos/modules/services/networking/zerobin.nix
index 0673070d1ee6..96cf4cc7148d 100644
--- a/nixos/modules/services/networking/zerobin.nix
+++ b/nixos/modules/services/networking/zerobin.nix
@@ -91,14 +91,14 @@ in
       enable = true;
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStartPre = [
-        "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}"
-        "${lib.getExe' pkgs.coreutils "chown"} ${cfg.user} ${cfg.dataDir}"
-      ];
       serviceConfig.ExecStart = "${pkgs.zerobin}/bin/zerobin ${cfg.listenAddress} ${toString cfg.listenPort} false ${cfg.user} ${cfg.group} ${zerobin_config}";
       serviceConfig.PrivateTmp = "yes";
       serviceConfig.User = cfg.user;
       serviceConfig.Group = cfg.group;
+      preStart = ''
+        mkdir -p ${cfg.dataDir}
+        chown ${cfg.user} ${cfg.dataDir}
+      '';
     };
   };
 }
diff --git a/nixos/modules/services/security/authelia.nix b/nixos/modules/services/security/authelia.nix
index 33c0be9e788a..059337e3a425 100644
--- a/nixos/modules/services/security/authelia.nix
+++ b/nixos/modules/services/security/authelia.nix
@@ -375,10 +375,10 @@ in
             })
             // instance.environmentVariables;
 
+          preStart = "${execCommand} ${configArg} validate-config";
           serviceConfig = {
             User = instance.user;
             Group = instance.group;
-            ExecStartPre = "${execCommand} ${configArg} validate-config";
             ExecStart = "${execCommand} ${configArg}";
             Restart = "always";
             RestartSec = "5s";
diff --git a/nixos/modules/services/security/certmgr.nix b/nixos/modules/services/security/certmgr.nix
index a2e00ca35a82..6a744e572101 100644
--- a/nixos/modules/services/security/certmgr.nix
+++ b/nixos/modules/services/security/certmgr.nix
@@ -34,6 +34,11 @@ let
         [ spec ]
     ) (lib.attrValues cfg.specs)
   );
+
+  preStart = ''
+    ${lib.concatStringsSep " \\\n" ([ "mkdir -p" ] ++ map lib.escapeShellArg specPaths)}
+    ${cfg.package}/bin/certmgr -f ${certmgrYaml} check
+  '';
 in
 {
   options.services.certmgr = {
@@ -210,14 +215,11 @@ in
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
+      inherit preStart;
 
       serviceConfig = {
         Restart = "always";
         RestartSec = "10s";
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${lib.escapeShellArgs specPaths}"
-          "${lib.getExe cfg.package} -f ${certmgrYaml} check"
-        ];
         ExecStart = "${cfg.package}/bin/certmgr -f ${certmgrYaml}";
       };
     };
diff --git a/nixos/modules/services/security/hologram-agent.nix b/nixos/modules/services/security/hologram-agent.nix
index 6152a57ffb8c..21bedc4fabd2 100644
--- a/nixos/modules/services/security/hologram-agent.nix
+++ b/nixos/modules/services/security/hologram-agent.nix
@@ -55,8 +55,10 @@ in
         "network-link-dummy0.service"
         "network-addresses-dummy0.service"
       ];
+      preStart = ''
+        /run/current-system/sw/bin/rm -fv /run/hologram.sock
+      '';
       serviceConfig = {
-        ExecStartPre = "/run/current-system/sw/bin/rm -fv /run/hologram.sock";
         ExecStart = "${pkgs.hologram}/bin/hologram-agent -debug -conf ${cfgFile} -port ${cfg.httpPort}";
       };
     };
diff --git a/nixos/modules/services/web-apps/bluemap.nix b/nixos/modules/services/web-apps/bluemap.nix
index bd01d6470186..5829b7c3e0dd 100644
--- a/nixos/modules/services/web-apps/bluemap.nix
+++ b/nixos/modules/services/web-apps/bluemap.nix
@@ -298,8 +298,10 @@ in
         Type = "oneshot";
         Group = "nginx";
         UMask = "026";
-        ExecStart = "${lib.getExe pkgs.bluemap} -c ${configFolder} -gs -r";
       };
+      script = ''
+        ${lib.getExe pkgs.bluemap} -c ${configFolder} -gs -r
+      '';
     };
 
     systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
diff --git a/nixos/modules/services/web-apps/cloudlog.nix b/nixos/modules/services/web-apps/cloudlog.nix
index a0ec5fe4134b..bec59aa779e1 100644
--- a/nixos/modules/services/web-apps/cloudlog.nix
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -383,44 +383,37 @@ in
         cloudlog-upload-lotw = {
           description = "Upload QSOs to LoTW if certs have been provided";
           enable = cfg.upload-lotw.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/lotw/lotw_upload";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/lotw_upload";
         };
         cloudlog-update-lotw-users = {
           description = "Update LOTW Users Database";
           enable = cfg.update-lotw-users.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/lotw/load_users";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/load_users";
         };
         cloudlog-update-dok = {
           description = "Update DOK File for autocomplete";
           enable = cfg.update-dok.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_dok";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_dok";
         };
         cloudlog-update-clublog-scp = {
           description = "Update Clublog SCP Database File";
           enable = cfg.update-clublog-scp.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_clublog_scp";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_clublog_scp";
         };
         cloudlog-update-wwff = {
           description = "Update WWFF File for autocomplete";
           enable = cfg.update-wwff.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_wwff";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_wwff";
         };
         cloudlog-upload-qrz = {
           description = "Upload QSOs to QRZ Logbook";
           enable = cfg.upload-qrz.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/qrz/upload";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/qrz/upload";
         };
         cloudlog-update-sota = {
           description = "Update SOTA File for autocomplete";
           enable = cfg.update-sota.enable;
-          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_sota";
-          serviceConfig.Type = "oneshot";
+          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_sota";
         };
       };
       timers = {
diff --git a/nixos/modules/services/web-apps/galene.nix b/nixos/modules/services/web-apps/galene.nix
index 6733a95d706c..969615e6490a 100644
--- a/nixos/modules/services/web-apps/galene.nix
+++ b/nixos/modules/services/web-apps/galene.nix
@@ -133,16 +133,19 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        ${optionalString (cfg.insecure != true && cfg.certFile != null && cfg.keyFile != null) ''
+          install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem
+          install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem
+        ''}
+      '';
+
       serviceConfig = mkMerge [
         {
           Type = "simple";
           User = cfg.user;
           Group = cfg.group;
           WorkingDirectory = cfg.stateDir;
-          ExecStartPre = lib.mkIf (cfg.insecure != true && cfg.certFile != null && cfg.keyFile != null) [
-            "${lib.getExe' pkgs.coreutils "install"} -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem"
-            "${lib.getExe' pkgs.coreutils "install"} -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem"
-          ];
           ExecStart = ''
             ${cfg.package}/bin/galene \
             ${optionalString (cfg.insecure) "-insecure"} \
diff --git a/nixos/modules/services/web-apps/glitchtip.nix b/nixos/modules/services/web-apps/glitchtip.nix
index 54ddf7f542b6..6a74cda886a1 100644
--- a/nixos/modules/services/web-apps/glitchtip.nix
+++ b/nixos/modules/services/web-apps/glitchtip.nix
@@ -236,8 +236,11 @@ in
         glitchtip = commonService // {
           description = "GlitchTip";
 
+          preStart = ''
+            ${lib.getExe pkg} migrate
+          '';
+
           serviceConfig = commonServiceConfig // {
-            ExecStartPre = "${lib.getExe pkg} migrate";
             ExecStart = ''
               ${lib.getExe python.pkgs.gunicorn} \
                 --bind=${cfg.listenAddress}:${toString cfg.port} \
diff --git a/nixos/modules/services/web-apps/healthchecks.nix b/nixos/modules/services/web-apps/healthchecks.nix
index ea97222f25e0..eec40a8a07f9 100644
--- a/nixos/modules/services/web-apps/healthchecks.nix
+++ b/nixos/modules/services/web-apps/healthchecks.nix
@@ -237,13 +237,14 @@ in
           wantedBy = [ "healthchecks.target" ];
           after = [ "healthchecks-migration.service" ];
 
+          preStart = ''
+            ${pkg}/opt/healthchecks/manage.py collectstatic --no-input
+            ${pkg}/opt/healthchecks/manage.py remove_stale_contenttypes --no-input
+          ''
+          + lib.optionalString (cfg.settings.DEBUG != "True") "${pkg}/opt/healthchecks/manage.py compress";
+
           serviceConfig = commonConfig // {
             Restart = "always";
-            ExecStartPre = [
-              "${pkg}/opt/healthchecks/manage.py collectstatic --no-input"
-              "${pkg}/opt/healthchecks/manage.py remove_stale_contenttypes --no-input"
-            ]
-            ++ lib.optionals (cfg.settings.DEBUG != "True") [ "${pkg}/opt/healthchecks/manage.py compress" ];
             ExecStart = ''
               ${pkgs.python3Packages.gunicorn}/bin/gunicorn hc.wsgi \
                 --bind ${cfg.listenAddress}:${toString cfg.port} \
diff --git a/nixos/modules/services/web-apps/mediagoblin.nix b/nixos/modules/services/web-apps/mediagoblin.nix
index 934afe082dae..081bfa763f9b 100644
--- a/nixos/modules/services/web-apps/mediagoblin.nix
+++ b/nixos/modules/services/web-apps/mediagoblin.nix
@@ -310,6 +310,19 @@ in
       in
       {
         mediagoblin-celeryd = lib.recursiveUpdate serviceDefaults {
+          # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
+          # https://todo.sr.ht/~mediagoblin/mediagoblin/57
+          preStart = ''
+            cp --remove-destination ${
+              pkgs.writeText "mediagoblin.ini" (
+                lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
+                + "\n"
+                + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
+                  inherit (cfg.settings.mediagoblin) plugins;
+                }
+              )
+            } /var/lib/mediagoblin/mediagoblin.ini
+          '';
           serviceConfig = {
             Environment = [
               "CELERY_CONFIG_MODULE=mediagoblin.init.celery.from_celery"
@@ -318,19 +331,6 @@ in
               "MEDIAGOBLIN_CONFIG=/var/lib/mediagoblin/mediagoblin.ini"
               "PASTE_CONFIG=${pasteConfig}"
             ];
-            # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
-            # https://todo.sr.ht/~mediagoblin/mediagoblin/57
-            ExecStartPre = ''
-              ${lib.getExe' pkgs.coreutils "cp"} --remove-destination ${
-                pkgs.writeText "mediagoblin.ini" (
-                  lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
-                  + "\n"
-                  + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
-                    inherit (cfg.settings.mediagoblin) plugins;
-                  }
-                )
-              } /var/lib/mediagoblin/mediagoblin.ini
-            '';
             ExecStart = "${lib.getExe' finalPackage "celery"} worker --loglevel=INFO";
           };
           unitConfig.Description = "MediaGoblin Celery";
@@ -345,16 +345,16 @@ in
             "mediagoblin-celeryd.service"
             "postgresql.target"
           ];
+          preStart = ''
+            cp --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini
+            ${lib.getExe' finalPackage "gmg"} dbupdate
+          '';
           serviceConfig = {
             Environment = [
               "CELERY_ALWAYS_EAGER=false"
               "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
               "GST_PLUGIN_PATH=${GST_PLUGIN_PATH}"
             ];
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "cp"} --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini"
-              "${lib.getExe' finalPackage "gmg"} dbupdate"
-            ];
             ExecStart = "${lib.getExe' finalPackage "paster"} serve /var/lib/mediagoblin/paste.ini";
           };
           unitConfig.Description = "Mediagoblin";
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 3a94f943b426..dac5f508aa70 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -18,6 +18,14 @@ let
   cfg = config.services.miniflux;
 
   boolToInt = b: if b then 1 else 0;
+
+  pgbin = "${config.services.postgresql.package}/bin";
+  # The hstore extension is no longer needed as of v2.2.14
+  # and would prevent Miniflux from starting.
+  preStart = pkgs.writeScript "miniflux-pre-start" ''
+    #!${pkgs.runtimeShell}
+    ${pgbin}/psql "miniflux" -c "DROP EXTENSION IF EXISTS hstore"
+  '';
 in
 
 {
@@ -133,9 +141,7 @@ in
       serviceConfig = {
         Type = "oneshot";
         User = config.services.postgresql.superUser;
-        # The hstore extension is no longer needed as of v2.2.14
-        # and would prevent Miniflux from starting.
-        ExecStart = ''${config.services.postgresql.package}/bin/psql "miniflux" -c "DROP EXTENSION IF EXISTS hstore"'';
+        ExecStart = preStart;
       };
     };
 
diff --git a/nixos/modules/services/web-apps/misskey.nix b/nixos/modules/services/web-apps/misskey.nix
index d1f147fdfa11..c601943479cf 100644
--- a/nixos/modules/services/web-apps/misskey.nix
+++ b/nixos/modules/services/web-apps/misskey.nix
@@ -326,19 +326,19 @@ in
       environment = {
         MISSKEY_CONFIG_YML = "/run/misskey/default.yml";
       };
+      preStart = ''
+        install -m 700 ${settingsFormat.generate "misskey-config.yml" cfg.settings} /run/misskey/default.yml
+      ''
+      + (lib.optionalString (cfg.database.passwordFile != null) ''
+        ${pkgs.replace-secret}/bin/replace-secret '@DATABASE_PASSWORD@' "${cfg.database.passwordFile}" /run/misskey/default.yml
+      '')
+      + (lib.optionalString (cfg.redis.passwordFile != null) ''
+        ${pkgs.replace-secret}/bin/replace-secret '@REDIS_PASSWORD@' "${cfg.redis.passwordFile}" /run/misskey/default.yml
+      '')
+      + (lib.optionalString (cfg.meilisearch.keyFile != null) ''
+        ${pkgs.replace-secret}/bin/replace-secret '@MEILISEARCH_KEY@' "${cfg.meilisearch.keyFile}" /run/misskey/default.yml
+      '');
       serviceConfig = {
-        ExecStartPre = [
-          "${lib.getExe' pkgs.coreutils "install"} -m 700 ${settingsFormat.generate "misskey-config.yml" cfg.settings} /run/misskey/default.yml"
-        ]
-        ++ (lib.optionals (cfg.database.passwordFile != null) [
-          "${lib.getExe pkgs.replace-secret} '@DATABASE_PASSWORD@' '${cfg.database.passwordFile}' /run/misskey/default.yml"
-        ])
-        ++ (lib.optionals (cfg.redis.passwordFile != null) [
-          "${lib.getExe pkgs.replace-secret} '@REDIS_PASSWORD@' '${cfg.redis.passwordFile}' /run/misskey/default.yml"
-        ])
-        ++ (lib.optionals (cfg.meilisearch.keyFile != null) [
-          "${lib.getExe pkgs.replace-secret} '@MEILISEARCH_KEY@' '${cfg.meilisearch.keyFile}' /run/misskey/default.yml"
-        ]);
         ExecStart = "${cfg.package}/bin/misskey migrateandstart";
         RuntimeDirectory = "misskey";
         RuntimeDirectoryMode = "700";
diff --git a/nixos/modules/services/web-apps/nexus.nix b/nixos/modules/services/web-apps/nexus.nix
index 8afba754315f..1a97c88900f9 100644
--- a/nixos/modules/services/web-apps/nexus.nix
+++ b/nixos/modules/services/web-apps/nexus.nix
@@ -142,8 +142,9 @@ in
         fi
       '';
 
+      script = "${cfg.package}/bin/nexus run";
+
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/nexus run";
         User = cfg.user;
         Group = cfg.group;
         PrivateTmp = true;
diff --git a/nixos/modules/services/web-apps/part-db.nix b/nixos/modules/services/web-apps/part-db.nix
index eb110d4362c0..086cf8b31213 100644
--- a/nixos/modules/services/web-apps/part-db.nix
+++ b/nixos/modules/services/web-apps/part-db.nix
@@ -200,7 +200,6 @@ in
           requires = [ "postgresql.target" ];
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
-            ExecStart = "${lib.getExe cfg.phpPackage} ${lib.getExe' cfg.package "console"} doctrine:migrations:migrate --no-interaction";
             Type = "oneshot";
             RemainAfterExit = true;
             User = "part-db";
@@ -208,6 +207,10 @@ in
           restartTriggers = [
             cfg.package
           ];
+          script = ''
+            set -euo pipefail
+            ${lib.getExe cfg.phpPackage} ${lib.getExe' cfg.package "console"} doctrine:migrations:migrate --no-interaction
+          '';
         };
 
         phpfpm-part-db = {
diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix
index 046122e3b704..40533ae760e1 100644
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -307,8 +307,11 @@ in
           ]
           ++ lib.optionals (cfg.environmentFile != null) [ "peering-manager-config.service" ];
 
+          preStart = ''
+            ${pkg}/bin/peering-manager remove_stale_contenttypes --no-input
+          '';
+
           serviceConfig = {
-            ExecStartPre = "${pkg}/bin/peering-manager remove_stale_contenttypes --no-input";
             ExecStart = ''
               ${pkg.python.pkgs.gunicorn}/bin/gunicorn peering_manager.wsgi \
                 --bind ${cfg.listenAddress}:${toString cfg.port} \
diff --git a/nixos/modules/services/web-apps/silverbullet.nix b/nixos/modules/services/web-apps/silverbullet.nix
index 6d14842ebebc..789fafb68f7f 100644
--- a/nixos/modules/services/web-apps/silverbullet.nix
+++ b/nixos/modules/services/web-apps/silverbullet.nix
@@ -95,6 +95,7 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = lib.mkIf (!lib.hasPrefix "/var/lib/" cfg.spaceDir) "mkdir -p '${cfg.spaceDir}'";
       serviceConfig = {
         Type = "simple";
         User = "${cfg.user}";
@@ -103,9 +104,6 @@ in
         StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/" cfg.spaceDir) (
           lib.last (lib.splitString "/" cfg.spaceDir)
         );
-        ExecStartPre = lib.mkIf (
-          !lib.hasPrefix "/var/lib/" cfg.spaceDir
-        ) "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.spaceDir}'";
         ExecStart =
           "${lib.getExe cfg.package} --port ${toString cfg.listenPort} --hostname '${cfg.listenAddress}' '${cfg.spaceDir}' "
           + lib.concatStringsSep " " cfg.extraArgs;
diff --git a/nixos/modules/services/web-apps/wakapi.nix b/nixos/modules/services/web-apps/wakapi.nix
index 4533d322d2b8..6634e4894546 100644
--- a/nixos/modules/services/web-apps/wakapi.nix
+++ b/nixos/modules/services/web-apps/wakapi.nix
@@ -143,6 +143,10 @@ in
       ++ optional (cfg.database.dialect == "postgres") "postgresql.target";
       wantedBy = [ "multi-user.target" ];
 
+      script = ''
+        exec ${getExe cfg.package} -config ${settingsFile}
+      '';
+
       serviceConfig = {
         Environment = mkMerge [
           (mkIf (cfg.passwordSalt != null) "WAKAPI_PASSWORD_SALT=${cfg.passwordSalt}")
@@ -153,8 +157,6 @@ in
           (lib.optional (cfg.passwordSaltFile != null) cfg.passwordSaltFile)
           ++ (lib.optional (cfg.smtpPasswordFile != null) cfg.smtpPasswordFile);
 
-        ExecStart = "${getExe cfg.package} -config ${settingsFile}";
-
         User = config.users.users.wakapi.name;
         Group = config.users.users.wakapi.group;
 
diff --git a/nixos/modules/services/web-servers/h2o/default.nix b/nixos/modules/services/web-servers/h2o/default.nix
index 719f6401103e..331c31fefc9b 100644
--- a/nixos/modules/services/web-servers/h2o/default.nix
+++ b/nixos/modules/services/web-servers/h2o/default.nix
@@ -443,7 +443,6 @@ in
       ++ builtins.map (certName: "acme-${certName}.service") acmeCertNames.all;
 
       serviceConfig = {
-        ExecStartPre = "${h2oExe} --mode 'test'";
         ExecStart = "${h2oExe} --mode 'master'";
         ExecReload = [
           "${h2oExe} --mode 'test'"
@@ -484,6 +483,8 @@ in
         AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         CapabilitiesBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
       };
+
+      preStart = "${h2oExe} --mode 'test'";
     };
 
     # This service waits for all certificates to be available before reloading
diff --git a/nixos/modules/services/web-servers/jboss/default.nix b/nixos/modules/services/web-servers/jboss/default.nix
index 516f887022b8..88bd1071b35b 100644
--- a/nixos/modules/services/web-servers/jboss/default.nix
+++ b/nixos/modules/services/web-servers/jboss/default.nix
@@ -93,7 +93,7 @@ in
   config = mkIf config.services.jboss.enable {
     systemd.services.jboss = {
       description = "JBoss server";
-      serviceConfig.ExecStart = "${jbossService}/bin/control start";
+      script = "${jbossService}/bin/control start";
       wantedBy = [ "multi-user.target" ];
     };
   };
diff --git a/nixos/tests/paperless.nix b/nixos/tests/paperless.nix
index 64610e584e01..3f215febda7c 100644
--- a/nixos/tests/paperless.nix
+++ b/nixos/tests/paperless.nix
@@ -116,9 +116,9 @@
           assert "1 timers listed." in timers, "incorrect number of timers"
 
           # Double check that our attrset option override works as expected
-          cmdline = node.succeed("systemctl cat paperless-exporter | grep ExecStart | grep 'paperless-manage' | cut -f 2 -d=")
+          cmdline = node.succeed("grep 'paperless-manage' $(systemctl cat paperless-exporter | grep ExecStart | cut -f 2 -d=)")
           print(f"Exporter command line {cmdline!r}")
-          assert cmdline.strip().endswith("paperless-manage document_exporter /var/lib/paperless/export --compare-checksums --delete --no-progress-bar --no-thumbnail"), "Unexpected exporter command line"
+          assert cmdline.strip() == "paperless-manage document_exporter /var/lib/paperless/export --compare-checksums --delete --no-progress-bar --no-thumbnail", "Unexpected exporter command line"
 
     test_paperless(simple)
     simple.send_monitor_command("quit")