diff --git a/nixos/modules/services/mail/pfix-srsd.nix b/nixos/modules/services/mail/pfix-srsd.nix
index 7ad2b20454d0..d4176c509d7a 100644
--- a/nixos/modules/services/mail/pfix-srsd.nix
+++ b/nixos/modules/services/mail/pfix-srsd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 {
 
   ###### interface
@@ -9,25 +6,25 @@ with lib;
   options = {
 
     services.pfix-srsd = {
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = "Whether to run the postfix sender rewriting scheme daemon.";
       };
 
-      domain = mkOption {
+      domain = lib.mkOption {
         description = "The domain for which to enable srs";
-        type = types.str;
+        type = lib.types.str;
         example = "example.com";
       };
 
-      secretsFile = mkOption {
+      secretsFile = lib.mkOption {
         description = ''
           The secret data used to encode the SRS address.
           to generate, use a command like:
           `for n in $(seq 5); do dd if=/dev/urandom count=1 bs=1024 status=none | sha256sum | sed 's/  -$//' | sed 's/^/          /'; done`
         '';
-        type = types.path;
+        type = lib.types.path;
         default = "/var/lib/pfix-srsd/secrets";
       };
     };
@@ -35,7 +32,7 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.services.pfix-srsd.enable {
+  config = lib.mkIf config.services.pfix-srsd.enable {
     environment = {
       systemPackages = [ pkgs.pfixtools ];
     };