From eaa2277e8d4c03f72926dffa14103e4cdee1f046 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20K=C3=B6gler?= <ck3d@gmx.de>
Date: Sat, 11 Apr 2026 08:26:42 +0200
Subject: [PATCH] nixos/systemd: fix service `sshd-vsock@`

---
 nixos/modules/system/boot/systemd.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 0b9124709f85..2fdd0e1a017a 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -876,6 +876,14 @@ in
         pamMount = false;
       };
     };
+
+    # the systemd vmspawn credential dropin executes sshd and expects ExecSearchPath to be set, see:
+    # https://github.com/systemd/systemd/blob/v259.3/src/vmspawn/vmspawn.c#L2662
+    # this service is used, for example, when NixOS is started via systemd-vmspawn
+    systemd.services."sshd-vsock@" = mkIf config.services.openssh.enable {
+      serviceConfig.ExecSearchPath = "${config.services.openssh.package}/bin";
+      overrideStrategy = "asDropin";
+    };
   };
 
   # FIXME: Remove these eventually.