diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 56e07f8da670..9deb7dc008b0 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -31,6 +31,7 @@ let
           "doc"
           "lib"
           "maintainers"
+          "modules"
           "nixos"
           "pkgs"
           ".version"
diff --git a/nixos/lib/eval-cacheable-options.nix b/nixos/lib/eval-cacheable-options.nix
index 73cf5eda32ec..9641d8d8d422 100644
--- a/nixos/lib/eval-cacheable-options.nix
+++ b/nixos/lib/eval-cacheable-options.nix
@@ -49,6 +49,7 @@ let
     version = release;
     revision = "release-${release}";
     prefix = modulesPath;
+    extraSources = [ (dirOf nixosPath) ];
   };
 in
 docs.optionsNix
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index 3a60ae3286d2..7dd2a481004a 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -116,18 +116,34 @@ let
           && (t == "directory" -> baseNameOf n != "tests")
           && (t == "file" -> hasSuffix ".nix" n)
         );
+        prefixRegex = "^" + lib.strings.escapeRegex (toString pkgs.path) + "($|/(modules|nixos)($|/.*))";
+        filteredModules = builtins.path {
+          name = "source";
+          inherit (pkgs) path;
+          filter =
+            n: t:
+            builtins.match prefixRegex n != null
+            && cleanSourceFilter n t
+            && (t == "directory" -> baseNameOf n != "tests")
+            && (t == "file" -> hasSuffix ".nix" n);
+        };
       in
       pkgs.runCommand "lazy-options.json"
-        {
+        rec {
           libPath = filter (pkgs.path + "/lib");
           pkgsLibPath = filter (pkgs.path + "/pkgs/pkgs-lib");
-          nixosPath = filter (pkgs.path + "/nixos");
+          nixosPath = filteredModules + "/nixos";
           NIX_ABORT_ON_WARN = warningsAreErrors;
           modules =
             "[ "
             + concatMapStringsSep " " (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy
             + " ]";
           passAsFile = [ "modules" ];
+          disallowedReferences = [
+            filteredModules
+            libPath
+            pkgsLibPath
+          ];
         }
         ''
           export NIX_STORE_DIR=$TMPDIR/store