{ utils, ... }: {
  # Use /var/lib/persist as the persistence root, matching Disko's mountpoint
  environment.persistence."/var/lib/persist" = {
    hideMounts = true;
    directories = [
      "/var/lib/nixos"
      "/var/lib/systemd/coredump"
      "/var/lib/systemd/timers"

      "/var/lib/backups"
      "/var/lib/headscale"
      "/var/lib/caddy" # for certs
      {
        directory = "/var/lib/secrets";
        user = "root";
        group = "root";
        mode = "u=rwx,g=,o=";
      }
    ];
    files = [
      "/etc/machine-id"
      "/etc/shadow"
      "/etc/passwd"
    ];
  };

  boot.initrd.systemd.services.wipe-root = {
    # Specify dependencies explicitly
    unitConfig.DefaultDependencies = false;
    serviceConfig.Type = "oneshot";
    wantedBy = [ "initrd.target" ];
    before = [ "sysroot.mount" ]; # before any fs are mounted

    # Wait for the disk to appear
    requires = [
      "${utils.escapeSystemPath "/dev/disk/by-partlabel/root"}.device"
    ];
    after = [
      "${utils.escapeSystemPath "/dev/disk/by-partlabel/root"}.device"
      # Allow hibernation to resume before trying to alter any data
      "local-fs-pre.target"
    ];

    script = ''
      mkdir /btrfs_tmp
      mount /dev/disk/by-label/root /btrfs_tmp
      trap 'umount /btrfs_tmp' EXIT
      if [ -e /btrfs_tmp/root ]; then
        mkdir -p /btrfs_tmp/old_roots
        timestamp="$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")"
        mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
      fi

      find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30 -print0 |
        xargs --null -I '{}' btrfs subvolume delete --recursive '{}'

      btrfs subvolume create /btrfs_tmp/root
    '';
  };
}