Heads up: when I upgraded network name resolution broke. It looks like the problem was services.mullvad. Unfortunately booting into an old generation still left me in a broken state. I guess there is some non-declarative state set. If you get into this situation there is a recovery procedure given here: https://github.com/NixOS/nixpkgs/issues/314694