diff --git a/nixos/modules/services/networking/ifstate.nix b/nixos/modules/services/networking/ifstate.nix
index 5bd748504f09..772fe831a860 100644
--- a/nixos/modules/services/networking/ifstate.nix
+++ b/nixos/modules/services/networking/ifstate.nix
@@ -106,7 +106,7 @@ in
       settings = lib.mkOption {
         inherit (settingsFormat) type;
         default = { };
-        description = "Content of IfState's configuration file. See <https://ifstate.net/2.0/schema/> for details.";
+        description = "Content of IfState's configuration file. See <https://ifstate.net/2.2/schema/> for details.";
       };
     };
 
@@ -131,19 +131,27 @@ in
       settings = lib.mkOption {
         inherit (settingsFormat) type;
         default = { };
-        description = "Content of IfState's initrd configuration file. See <https://ifstate.net/2.0/schema/> for details.";
+        description = "Content of IfState's initrd configuration file. See <https://ifstate.net/2.2/schema/> for details.";
       };
 
       cleanupSettings = lib.mkOption {
         inherit (settingsFormat) type;
         # required by json schema
         default.interfaces = { };
-        description = "Content of IfState's initrd cleanup configuration file. See <https://ifstate.net/2.0/schema/> for details. This configuration gets applied before systemd switches to stage two. The goas is to deconfigurate the whole network in order to prevent access to services, before the firewall is configured. The stage two IfState configuration will start after the firewall is configured.";
+        description = "Content of IfState's initrd cleanup configuration file. See <https://ifstate.net/2.0/schema/> for details. This configuration gets applied before systemd switches to stage two. The goal is to deconfigurate the whole network in order to prevent access to services, before the firewall is configured. The stage two IfState configuration will start after the firewall is configured.";
       };
     };
   };
 
   config = lib.mkMerge [
+    (lib.mkIf (cfg.enable || initrdCfg.enable) {
+      # sane defaults to not let IfState work against the kernel
+      boot.extraModprobeConfig = ''
+        options bonding max_bonds=0
+        options dummy numdummies=0
+        options ifb numifbs=0
+      '';
+    })
     (lib.mkIf cfg.enable {
       assertions = [
         {
@@ -158,13 +166,6 @@ in
 
       networking.useDHCP = lib.mkDefault false;
 
-      # sane defaults to not let IfState work against the kernel
-      boot.extraModprobeConfig = ''
-        options bonding max_bonds=0
-        options dummy numdummies=0
-        options ifb numifbs=0
-      '';
-
       environment = {
         # ifstatecli command should be available to use user, there are other useful subcommands like check or show
         systemPackages = [ cfg.package ];
diff --git a/nixos/tests/ifstate/initrd-partial-broken-config.nix b/nixos/tests/ifstate/initrd-partial-broken-config.nix
index 2acd9226dde9..c29540ccd390 100644
--- a/nixos/tests/ifstate/initrd-partial-broken-config.nix
+++ b/nixos/tests/ifstate/initrd-partial-broken-config.nix
@@ -28,6 +28,9 @@ in
         };
 
         boot.initrd = {
+          # otherwise the interfaces do not get created
+          kernelModules = [ "virtio_net" ];
+
           network = {
             enable = true;
             ifstate = lib.mkMerge [
@@ -46,6 +49,7 @@ in
               }
             ];
           };
+
           systemd = {
             enable = true;
             network.enable = false;
diff --git a/nixos/tests/ifstate/initrd-wireguard.nix b/nixos/tests/ifstate/initrd-wireguard.nix
index 6eb90c49a829..932e6bf5aece 100644
--- a/nixos/tests/ifstate/initrd-wireguard.nix
+++ b/nixos/tests/ifstate/initrd-wireguard.nix
@@ -10,19 +10,20 @@ let
     {
       enable = true;
       settings = {
-        interfaces = {
-          eth1 = {
-            addresses = [ "2001:0db8:a::${builtins.toString id}/64" ];
-            link = {
-              state = "up";
-              kind = "physical";
-            };
+        namespaces.outside.interfaces.eth1 = {
+          addresses = [ "2001:0db8:a::${builtins.toString id}/64" ];
+          link = {
+            state = "up";
+            kind = "physical";
           };
+        };
+        interfaces = {
           wg0 = {
             addresses = [ "2001:0db8:b::${builtins.toString id}/64" ];
             link = {
               state = "up";
               kind = "wireguard";
+              bind_netns = "outside";
             };
             wireguard = {
               private_key = "!include ${pkgs.writeText "wg_priv.key" wgPriv}";
@@ -61,6 +62,9 @@ in
         };
 
         boot.initrd = {
+          # otherwise the interfaces do not get created
+          kernelModules = [ "virtio_net" ];
+
           network = {
             enable = true;
             ifstate =
@@ -72,12 +76,10 @@ in
                 wgPeerId = 2;
               }
               // {
-                package = pkgs.ifstate.override {
-                  withConfigValidation = false;
-                };
                 allowIfstateToDrasticlyIncreaseInitrdSize = true;
               };
           };
+
           systemd = {
             enable = true;
             network.enable = false;
diff --git a/nixos/tests/ifstate/initrd.nix b/nixos/tests/ifstate/initrd.nix
index 01ed9a513ccd..546f5c8114bd 100644
--- a/nixos/tests/ifstate/initrd.nix
+++ b/nixos/tests/ifstate/initrd.nix
@@ -26,12 +26,16 @@ in
       };
 
       boot.initrd = {
+        # otherwise the interfaces do not get created
+        kernelModules = [ "virtio_net" ];
+
         network = {
           enable = true;
           ifstate = mkIfStateConfig 1 // {
             allowIfstateToDrasticlyIncreaseInitrdSize = true;
           };
         };
+
         systemd = {
           enable = true;
           network.enable = false;