_: {
    fileSystems."/boot".options = [ "nodev" "nosuid" "noexec" ];
}