diff --git a/lib/generators.nix b/lib/generators.nix
index 376aa4081bf4..352644df0431 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -606,12 +606,12 @@ in rec {
 
   in
   # TODO: As discussed in #356502, deprecated functionality should be removed sometime after 25.11.
-  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated"
-  ''<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-${expr "" v}
-</plist>'';
+  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated" ''
+  <?xml version="1.0" encoding="UTF-8"?>
+  <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+  <plist version="1.0">
+  ${expr "" v}
+  </plist>'';
 
   /**
     Translate a simple Nix expression to Dhall notation.
diff --git a/lib/lists.nix b/lib/lists.nix
index ca436d7a9c94..4a325bb307af 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -1748,8 +1748,8 @@ rec {
     ```
     :::
   */
-  crossLists = warn
-    ''lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
+  crossLists = warn ''
+    lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
 
     For example, the following function call:
 
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index c1594ff2086a..491aab1d1eb0 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -106,7 +106,7 @@ let
       path =  [
         config.services.borgbackup.package pkgs.openssh
       ];
-      script = "exec " + lib.optionalString cfg.inhibitsSleep ''\
+      script = "exec " + lib.optionalString cfg.inhibitsSleep ''
         ${pkgs.systemd}/bin/systemd-inhibit \
             --who="borgbackup" \
             --what="sleep" \
@@ -183,7 +183,7 @@ let
       mode != "none" -> passCommand != null || passphrase != null;
     message =
       "passCommand or passphrase has to be specified because"
-      + '' borgbackup.jobs.${name}.encryption != "none"'';
+      + " borgbackup.jobs.${name}.encryption != \"none\"";
   };
 
   mkRepoService = name: cfg:
diff --git a/nixos/modules/services/cluster/kubernetes/apiserver.nix b/nixos/modules/services/cluster/kubernetes/apiserver.nix
index e05bcb37e819..e40893f5aed8 100644
--- a/nixos/modules/services/cluster/kubernetes/apiserver.nix
+++ b/nixos/modules/services/cluster/kubernetes/apiserver.nix
@@ -320,7 +320,8 @@ in
           after = [ "network.target" ];
           serviceConfig = {
             Slice = "kubernetes.slice";
-            ExecStart = ''${top.package}/bin/kube-apiserver \
+            ExecStart = ''
+              ${top.package}/bin/kube-apiserver \
               --allow-privileged=${lib.boolToString cfg.allowPrivileged} \
               --authorization-mode=${lib.concatStringsSep "," cfg.authorizationMode} \
                 ${lib.optionalString (lib.elem "ABAC" cfg.authorizationMode)
diff --git a/nixos/modules/services/cluster/kubernetes/proxy.nix b/nixos/modules/services/cluster/kubernetes/proxy.nix
index 2e3fdc87b439..7cf2591338d9 100644
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@@ -65,7 +65,8 @@ in
       path = with pkgs; [ iptables conntrack-tools ];
       serviceConfig = {
         Slice = "kubernetes.slice";
-        ExecStart = ''${top.package}/bin/kube-proxy \
+        ExecStart = ''
+          ${top.package}/bin/kube-proxy \
           --bind-address=${cfg.bindAddress} \
           ${optionalString (top.clusterCidr!=null)
             "--cluster-cidr=${top.clusterCidr}"} \
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 31532646f8ed..b542e94bf80d 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -211,7 +211,8 @@ in {
             masterAuth = lib.mkOption {
               type = with types; nullOr str;
               default = null;
-              description = ''If the master is password protected (using the requirePass configuration)
+              description = ''
+              If the master is password protected (using the requirePass configuration)
               it is possible to tell the slave to authenticate before starting the replication synchronization
               process, otherwise the master will refuse the slave request.
               (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
diff --git a/nixos/modules/services/desktops/pipewire/wireplumber.nix b/nixos/modules/services/desktops/pipewire/wireplumber.nix
index cccb892cecf7..9b07c0eb2ad8 100644
--- a/nixos/modules/services/desktops/pipewire/wireplumber.nix
+++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix
@@ -61,7 +61,8 @@ in
         # in sections.
         type = attrsOf (attrsOf json.type);
         default = { };
-        example = literalExpression ''{
+        example = literalExpression ''
+        {
           "log-level-debug" = {
             "context.properties" = {
               # Output Debug log messages as opposed to only the default level (Notice)
@@ -88,7 +89,8 @@ in
               }
             ];
           };
-        }'';
+        }
+        '';
         description = ''
           Additional configuration for the WirePlumber daemon when run in
           single-instance mode (the default in nixpkgs and currently the only
@@ -166,7 +168,8 @@ in
       configPackages = mkOption {
         type = listOf package;
         default = [ ];
-        example = literalExpression ''[
+        example = literalExpression ''
+        [
           (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/10-bluez.conf" '''
             monitor.bluez.properties = {
               bluez5.roles = [ a2dp_sink a2dp_source bap_sink bap_source hsp_hs hsp_ag hfp_hf hfp_ag ]
@@ -175,7 +178,8 @@ in
               bluez5.hfphsp-backend = "native"
             }
           ''')
-        ]'';
+        ]
+        '';
         description = ''
           List of packages that provide WirePlumber configuration, in the form of
           `share/wireplumber/*/*.conf` files.
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 80bbee5f49ce..6acc2a6f6987 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1080,12 +1080,13 @@ in {
     warnings = [
       (mkIf
         (cfg.registry.enable && versionAtLeast (getVersion cfg.packages.gitlab) "16.0.0" && cfg.registry.package == pkgs.docker-distribution)
-        ''Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.
+        ''
+          Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.
           Please back up your data and migrate to the gitlab-container-registry package.''
       )
       (mkIf
-        (versionAtLeast (getVersion cfg.packages.gitlab) "16.2.0" && versionOlder (getVersion cfg.packages.gitlab) "16.5.0")
-        ''GitLab instances created or updated between versions [15.11.0, 15.11.2] have an incorrect database schema.
+        (versionAtLeast (getVersion cfg.packages.gitlab) "16.2.0" && versionOlder (getVersion cfg.packages.gitlab) "16.5.0") ''
+        GitLab instances created or updated between versions [15.11.0, 15.11.2] have an incorrect database schema.
         Check the upstream documentation for a workaround: https://docs.gitlab.com/ee/update/versions/gitlab_16_changes.html#undefined-column-error-upgrading-to-162-or-later''
       )
     ];
diff --git a/nixos/modules/services/network-filesystems/ceph.nix b/nixos/modules/services/network-filesystems/ceph.nix
index 5961731dbf44..d71019086f49 100644
--- a/nixos/modules/services/network-filesystems/ceph.nix
+++ b/nixos/modules/services/network-filesystems/ceph.nix
@@ -42,8 +42,9 @@ let
       StateDirectory = stateDirectory;
       User = "ceph";
       Group = if daemonType == "osd" then "disk" else "ceph";
-      ExecStart = ''${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \
-                    -f --cluster ${clusterName} --id ${daemonId}'';
+      ExecStart = ''
+        ${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \
+        -f --cluster ${clusterName} --id ${daemonId}'';
     } // lib.optionalAttrs (daemonType == "osd") {
       ExecStartPre = "${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${daemonId} --cluster ${clusterName}";
       RestartSec = "20s";
diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix
index f96853939bd2..483f579b354a 100644
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@@ -119,7 +119,8 @@ in
               MAX  0.5 144   7200
               MIN  0.5 144   7200
         '';
-        description = ''Configure the ping frequency and retention of the rrd files.
+        description = ''
+          Configure the ping frequency and retention of the rrd files.
           Once set, changing the interval will require deletion or migration of all
           the collected data.'';
       };
diff --git a/nixos/modules/services/networking/tinyproxy.nix b/nixos/modules/services/networking/tinyproxy.nix
index 6e07c6a541e9..bcf8fbbca726 100644
--- a/nixos/modules/services/networking/tinyproxy.nix
+++ b/nixos/modules/services/networking/tinyproxy.nix
@@ -33,14 +33,16 @@ in
       settings = mkOption {
         description = "Configuration for [tinyproxy](https://tinyproxy.github.io/).";
         default = { };
-        example = literalExpression ''{
+        example = literalExpression ''
+        {
           Port 8888;
           Listen 127.0.0.1;
           Timeout 600;
           Allow 127.0.0.1;
           Anonymous = ['"Host"' '"Authorization"'];
           ReversePath = '"/example/" "http://www.example.com/"';
-        }'';
+        }
+        '';
         type = types.submodule ({name, ...}: {
           freeformType = settingsFormat.type;
           options = {
diff --git a/nixos/modules/services/networking/wg-quick.nix b/nixos/modules/services/networking/wg-quick.nix
index 369c5a939765..2130c49f374e 100644
--- a/nixos/modules/services/networking/wg-quick.nix
+++ b/nixos/modules/services/networking/wg-quick.nix
@@ -194,7 +194,8 @@ let
       allowedIPs = mkOption {
         example = [ "10.192.122.3/32" "10.192.124.1/24" ];
         type = with types; listOf str;
-        description = ''List of IP (v4 or v6) addresses with CIDR masks from
+        description = ''
+        List of IP (v4 or v6) addresses with CIDR masks from
         which this peer is allowed to send incoming traffic and to which
         outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
         be specified for matching all IPv4 addresses, and ::/0 may be specified
@@ -205,7 +206,8 @@ let
         default = null;
         example = "demo.wireguard.io:12913";
         type = with types; nullOr str;
-        description = ''Endpoint IP or hostname of the peer, followed by a colon,
+        description = ''
+        Endpoint IP or hostname of the peer, followed by a colon,
         and then a port number of the peer.'';
       };
 
@@ -213,7 +215,8 @@ let
         default = null;
         type = with types; nullOr int;
         example = 25;
-        description = ''This is optional and is by default off, because most
+        description = ''
+        This is optional and is by default off, because most
         users will not need it. It represents, in seconds, between 1 and 65535
         inclusive, how often to send an authenticated empty packet to the peer,
         for the purpose of keeping a stateful firewall or NAT mapping valid
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index a3308a1cd396..5d9bcc9e767a 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -127,7 +127,8 @@ let
         default = null;
         type = with types; nullOr str;
         example = "container";
-        description = ''The pre-existing network namespace in which the
+        description = ''
+        The pre-existing network namespace in which the
         WireGuard interface is created, and which retains the socket even if the
         interface is moved via {option}`interfaceNamespace`. When
         `null`, the interface is created in the init namespace.
@@ -139,7 +140,8 @@ let
         default = null;
         type = with types; nullOr str;
         example = "init";
-        description = ''The pre-existing network namespace the WireGuard
+        description = ''
+        The pre-existing network namespace the WireGuard
         interface is moved to. The special value `init` means
         the init namespace. When `null`, the interface is not
         moved.
@@ -262,7 +264,8 @@ let
       allowedIPs = mkOption {
         example = [ "10.192.122.3/32" "10.192.124.1/24" ];
         type = with types; listOf str;
-        description = ''List of IP (v4 or v6) addresses with CIDR masks from
+        description = ''
+        List of IP (v4 or v6) addresses with CIDR masks from
         which this peer is allowed to send incoming traffic and to which
         outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
         be specified for matching all IPv4 addresses, and ::/0 may be specified
@@ -328,7 +331,8 @@ let
         default = null;
         type = with types; nullOr int;
         example = 25;
-        description = ''This is optional and is by default off, because most
+        description = ''
+        This is optional and is by default off, because most
         users will not need it. It represents, in seconds, between 1 and 65535
         inclusive, how often to send an authenticated empty packet to the peer,
         for the purpose of keeping a stateful firewall or NAT mapping valid
diff --git a/nixos/modules/services/web-apps/galene.nix b/nixos/modules/services/web-apps/galene.nix
index 013b8b3da8a0..133873cd94f0 100644
--- a/nixos/modules/services/web-apps/galene.nix
+++ b/nixos/modules/services/web-apps/galene.nix
@@ -150,7 +150,8 @@ in
           User = cfg.user;
           Group = cfg.group;
           WorkingDirectory = cfg.stateDir;
-          ExecStart = ''${cfg.package}/bin/galene \
+          ExecStart = ''
+          ${cfg.package}/bin/galene \
           ${optionalString (cfg.insecure) "-insecure"} \
           -http ${cfg.httpAddress}:${toString cfg.httpPort} \
           -turn ${cfg.turnAddress} \
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 64c17aa44b4a..10c72550f2cd 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -770,15 +770,17 @@ in {
       description = ''
         Extra options which should be appended to Nextcloud's config.php file.
       '';
-      example = literalExpression '' {
-        redis = {
-          host = "/run/redis/redis.sock";
-          port = 0;
-          dbindex = 0;
-          password = "secret";
-          timeout = 1.5;
-        };
-      } '';
+      example = literalExpression ''
+        {
+          redis = {
+            host = "/run/redis/redis.sock";
+            port = 0;
+            dbindex = 0;
+            password = "secret";
+            timeout = 1.5;
+          };
+        }
+      '';
     };
 
     secretFile = mkOption {
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 85e5631e77a2..3c42e6c04a48 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -319,8 +319,8 @@ in
 
     system.extraSystemBuilderCmds =
       optionalString
-        config.system.copySystemConfiguration
-        ''ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \
+        config.system.copySystemConfiguration ''
+          ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \
             "$out/configuration.nix"
         '' +
       optionalString