{ lib, ... }: {
  boot.initrd.postDeviceCommands = lib.mkAfter ''
    echo "Rollback running" > /mnt/rollback.log
    mkdir -p /mnt
    mount -t btrfs /dev/mapper/cryptroot /mnt

    # Recursively delete all nested subvolumes inside /mnt/root
    btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do
      echo "Deleting /$subvolume subvolume..." >> /mnt/rollback.log
      btrfs subvolume delete "/mnt/$subvolume"
    done

    echo "Deleting /root subvolume..." >> /mnt/rollback.log
    btrfs subvolume delete /mnt/root

    echo "Restoring blank /root subvolume..." >> /mnt/rollback.log
    btrfs subvolume snapshot /mnt/root-blank /mnt/root

    umount /mnt
  '';

  # Use /persist as the persistence root, matching Disko's mountpoint
  environment.persistence."/persist" = {
    hideMounts = true;
    directories = [
      "/var/lib/backups"
      "/var/lib/headscale"
      "/var/lib/caddy" # for certs
    ];
    files = [
      "/etc/machine-id"
      "/etc/shadow"
      "/etc/passwd"
    ];
  };
}