nixos/guix: replace systemd script with ExecStart

nixos/modules/services/misc/guix/default.nix

@@ -284,21 +284,21 @@ in
         # should be sandboxed.
         systemd.services.guix-daemon = {
           environment = serviceEnv // config.networking.proxy.envVars;
-          script = ''
-            exec ${lib.getExe' package "guix-daemon"} \
-              --build-users-group=${cfg.group} \
-              ${
-                lib.optionalString (
-                  cfg.substituters.urls != [ ]
-                ) "--substitute-urls='${lib.concatStringsSep " " cfg.substituters.urls}'"
-              } \
-              ${lib.escapeShellArgs cfg.extraArgs}
-          '';
           serviceConfig = {
             OOMPolicy = "continue";
             RemainAfterExit = "yes";
             Restart = "always";
             TasksMax = 8192;
+            ExecStart = ''
+              ${lib.getExe' package "guix-daemon"} \
+                --build-users-group=${cfg.group} \
+                ${
+                  lib.optionalString (
+                    cfg.substituters.urls != [ ]
+                  ) "--substitute-urls='${lib.concatStringsSep " " cfg.substituters.urls}'"
+                } \
+                ${lib.escapeShellArgs cfg.extraArgs}
+            '';
           };
           unitConfig.RequiresMountsFor = [
             cfg.storeDir
@@ -407,16 +407,17 @@ in
                 ${lib.getExe' package "guix"} archive --generate-key;
               }
           '';
-          script = ''
-            exec ${lib.getExe' package "guix"} publish \
-              --user=${cfg.publish.user} --port=${toString cfg.publish.port} \
-              ${lib.escapeShellArgs cfg.publish.extraArgs}
-          '';
 
           serviceConfig = {
             Restart = "always";
             RestartSec = 10;
 
+            ExecStart = ''
+              ${lib.getExe' package "guix"} publish \
+                --user=${cfg.publish.user} --port=${toString cfg.publish.port} \
+                ${lib.escapeShellArgs cfg.publish.extraArgs}
+            '';
+
             ProtectClock = true;
             ProtectHostname = true;
             ProtectKernelTunables = true;
@@ -463,11 +464,11 @@ in
         systemd.services.guix-gc = {
           description = "Guix garbage collection";
           startAt = cfg.gc.dates;
-          script = ''
-            exec ${lib.getExe' package "guix"} gc ${lib.escapeShellArgs cfg.gc.extraArgs}
-          '';
           serviceConfig = {
             Type = "oneshot";
+
+            ExecStart = "${lib.getExe' package "guix"} gc ${lib.escapeShellArgs cfg.gc.extraArgs}";
+
             PrivateDevices = true;
             PrivateNetwork = true;
             ProtectControlGroups = true;