anchor.diff:          WorkingDirectory = runtimeDir;
   
           InaccessiblePaths = [
  -          # Token file path given in the configuration
  -          cfg.tokenFile
  +          # Token file path given in the configuration, if visible to the service
  +          "-${cfg.tokenFile}"
             # Token file in the state directory
             "${stateDir}/${currentConfigTokenFilename}"
           ];
  
positive.code:                 rm    -rf "$STATE_DIRECTORY/_diag/"
  
                  # Cleanup token from config
                  rm "$STATE_DIRECTORY/${newConfigTokenFilename}"
  
                  # Symlink to new config
                  ln -s '${newConfigPath}' "${currentConfigPath}"
  
negative.code: 
                ${lines}
              '';
              runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" ] cfg;
              newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
              currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
              newConfigTokenPath= "$STATE_DIRECTORY/.new-token";
              currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
  
              runnerCredFiles = [
                ".credentials"
                ".credentials_rsaparams"
                ".runner"
              ];
              unconfigureRunner = writeScript "unconfigure" ''
                copy_tokens() {
                  # Copy the configured token file to the state dir and allow the service user to read the file
                  install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}"
                  # Also copy current file to allow for a diff on the next start
                  install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}"
                }
  
                clean_state() {
                  find "$STATE_DIRECTORY/" -mindepth 1 -delete
                  copy_tokens
                }
  
                diff_config() {
                  changed=0
  
                  # Check for module config changes
                  [[ -f "${currentConfigPath}" ]] \
                    && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \
                    || changed=1
  
                  # Also check the content of the token file
                  [[ -f "${currentConfigTokenPath}" ]] \
                    && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \
                    || changed=1
  
                  # If the config has changed, remove old state and copy tokens
                  if [[ "$changed" -eq 1 ]]; then
                    echo "Config has changed, removing old runner state."
                    echo "The old runner will still appear in the GitHub Actions UI." \
                         "You have to remove it manually."
                    clean_state
                  fi
                }
  
                if [[ "${optionalString cfg.ephemeral "1"}" ]]; then
                  # In ephemeral mode, we always want to start with a clean state
                  clean_state
                elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
                  # There are state files from a previous run; diff them to decide if we need a new registration
                  diff_config
                else
                  # The state directory is entirely empty which indicates a first start
                  copy_tokens
                fi
              '';
              configureRunner = writeScript "configure" ''
                if [[ -e "${newConfigTokenPath}" ]]; then
                  echo "Configuring GitHub Actions Runner"
  
                  args=(
  