diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index f0c6e836194d..c4b23a703737 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -368,7 +368,7 @@ in
         freeformType = settingsFormat.type;
 
         options = {
-          pam_allowed_login_groups = mkOption {
+          kanidm.pam_allowed_login_groups = mkOption {
             description = "Kanidm groups that are allowed to login using PAM.";
             example = "my_pam_group";
             type = types.listOf types.str;
@@ -673,6 +673,10 @@ in
 
   config = mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
     warnings = lib.optionals (cfg.package.eolMessage != "") [ cfg.package.eolMessage ];
+    services.kanidm = {
+      unixSettings.version = "2";
+      serverSettings.version = "2";
+    };
 
     assertions =
       let
@@ -710,6 +714,14 @@ in
           };
       in
       [
+        {
+          assertion = cfg.enablePam -> !(cfg.unixSettings ? pam_allowed_login_groups);
+          message = ''
+            <option>services.kanidm.unixSettings.pam_allowed_login_groups</option> has been renamed
+            to <option>services.kanidm.unixSettings.kanidm.pam_allowed_login_groups</option>.
+            Please change your usage.
+          '';
+        }
         {
           assertion =
             !cfg.enableServer
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index 78f71fce90c6..c9fd7bb2a083 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -66,7 +66,7 @@ in
         };
         enablePam = true;
         unixSettings = {
-          pam_allowed_login_groups = [ "shell" ];
+          kanidm.pam_allowed_login_groups = [ "shell" ];
         };
       };