diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix
index a5ee7efc3c32..f954a5284103 100644
--- a/nixos/modules/services/networking/firewall-nftables.nix
+++ b/nixos/modules/services/networking/firewall-nftables.nix
@@ -1,16 +1,13 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.networking.firewall;
 
-  ifaceSet = concatStringsSep ", " (
+  ifaceSet = lib.concatStringsSep ", " (
     map (x: ''"${x}"'') cfg.trustedInterfaces
   );
 
-  portsToNftSet = ports: portRanges: concatStringsSep ", " (
+  portsToNftSet = ports: portRanges: lib.concatStringsSep ", " (
     map (x: toString x) ports
     ++ map (x: "${toString x.from}-${toString x.to}") portRanges
   );
@@ -22,8 +19,8 @@ in
   options = {
 
     networking.firewall = {
-      extraInputRules = mkOption {
-        type = types.lines;
+      extraInputRules = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         example = "ip6 saddr { fc00::/7, fe80::/10 } tcp dport 24800 accept";
         description = ''
@@ -34,8 +31,8 @@ in
         '';
       };
 
-      extraForwardRules = mkOption {
-        type = types.lines;
+      extraForwardRules = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         example = "iifname wg0 accept";
         description = ''
@@ -46,8 +43,8 @@ in
         '';
       };
 
-      extraReversePathFilterRules = mkOption {
-        type = types.lines;
+      extraReversePathFilterRules = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         example = "fib daddr . mark . iif type local accept";
         description = ''
@@ -61,7 +58,7 @@ in
 
   };
 
-  config = mkIf (cfg.enable && config.networking.nftables.enable) {
+  config = lib.mkIf (cfg.enable && config.networking.nftables.enable) {
 
     assertions = [
       {
@@ -73,7 +70,7 @@ in
         message = "extraStopCommands is incompatible with the nftables based firewall: ${cfg.extraStopCommands}";
       }
       {
-        assertion = cfg.pingLimit == null || !(hasPrefix "--" cfg.pingLimit);
+        assertion = cfg.pingLimit == null || !(lib.hasPrefix "--" cfg.pingLimit);
         message = "nftables syntax like \"2/second\" should be used in networking.firewall.pingLimit";
       }
       {
@@ -84,16 +81,16 @@ in
 
     networking.nftables.tables."nixos-fw".family = "inet";
     networking.nftables.tables."nixos-fw".content = ''
-        ${optionalString (cfg.checkReversePath != false) ''
+        ${lib.optionalString (cfg.checkReversePath != false) ''
           chain rpfilter {
             type filter hook prerouting priority mangle + 10; policy drop;
 
             meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
-            fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
+            fib saddr . mark ${lib.optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
 
             jump rpfilter-allow
 
-            ${optionalString cfg.logReversePathDrops ''
+            ${lib.optionalString cfg.logReversePathDrops ''
               log level info prefix "rpfilter drop: "
             ''}
 
@@ -107,7 +104,7 @@ in
         chain input {
           type filter hook input priority filter; policy drop;
 
-          ${optionalString (ifaceSet != "") ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
+          ${lib.optionalString (ifaceSet != "") ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
 
           # Some ICMPv6 types like NDP is untracked
           ct state vmap {
@@ -118,18 +115,18 @@ in
             untracked: jump input-allow,
           }
 
-          ${optionalString cfg.logRefusedConnections ''
+          ${lib.optionalString cfg.logRefusedConnections ''
             tcp flags syn / fin,syn,rst,ack log level info prefix "refused connection: "
           ''}
-          ${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) ''
+          ${lib.optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) ''
             pkttype broadcast log level info prefix "refused broadcast: "
             pkttype multicast log level info prefix "refused multicast: "
           ''}
-          ${optionalString cfg.logRefusedPackets ''
+          ${lib.optionalString cfg.logRefusedPackets ''
             pkttype host log level info prefix "refused packet: "
           ''}
 
-          ${optionalString cfg.rejectPackets ''
+          ${lib.optionalString cfg.rejectPackets ''
             meta l4proto tcp reject with tcp reset
             reject
           ''}
@@ -138,20 +135,20 @@ in
 
         chain input-allow {
 
-          ${concatStrings (mapAttrsToList (iface: cfg:
+          ${lib.concatStrings (lib.mapAttrsToList (iface: cfg:
             let
-              ifaceExpr = optionalString (iface != "default") "iifname ${iface}";
+              ifaceExpr = lib.optionalString (iface != "default") "iifname ${iface}";
               tcpSet = portsToNftSet cfg.allowedTCPPorts cfg.allowedTCPPortRanges;
               udpSet = portsToNftSet cfg.allowedUDPPorts cfg.allowedUDPPortRanges;
             in
             ''
-              ${optionalString (tcpSet != "") "${ifaceExpr} tcp dport { ${tcpSet} } accept"}
-              ${optionalString (udpSet != "") "${ifaceExpr} udp dport { ${udpSet} } accept"}
+              ${lib.optionalString (tcpSet != "") "${ifaceExpr} tcp dport { ${tcpSet} } accept"}
+              ${lib.optionalString (udpSet != "") "${ifaceExpr} udp dport { ${udpSet} } accept"}
             ''
           ) cfg.allInterfaces)}
 
-          ${optionalString cfg.allowPing ''
-            icmp type echo-request ${optionalString (cfg.pingLimit != null) "limit rate ${cfg.pingLimit}"} accept comment "allow ping"
+          ${lib.optionalString cfg.allowPing ''
+            icmp type echo-request ${lib.optionalString (cfg.pingLimit != null) "limit rate ${cfg.pingLimit}"} accept comment "allow ping"
           ''}
 
           icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
@@ -161,7 +158,7 @@ in
 
         }
 
-        ${optionalString cfg.filterForward ''
+        ${lib.optionalString cfg.filterForward ''
           chain forward {
             type filter hook forward priority filter; policy drop;