anchor.diff:            ${optionalString (header != null) "--header=${header}"} \
             > /.luksopen_args
           ${optionalString (keyFile != null) ''
  -        ${optionalString fallback "if [ -e ${keyFile} ]; then"}
  +        ${optionalString fallbackToPassword "if [ -e ${keyFile} ]; then"}
               echo " --key-file=${keyFile} ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"}" \
                 >> /.luksopen_args
  -        ${optionalString fallback ''
  +        ${optionalString fallbackToPassword ''
           else
               echo "keyfile ${keyFile} not found -- fallback to interactive unlocking"
           fi
  
positive.code: let
    luks = config.boot.initrd.luks;
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, allowDiscards, yubikey, fallback, ... }: assert name' == name; ''
  
      # Wait for a target (e.g. device, keyFile, header, ...) to appear.
      wait_target() {
  
negative.code:             '';
            };
  
            fallbackToPassword = mkOption {
              default = false;
              type = types.bool;
              description = ''
  