anchor.diff:  
     config = mkIf (cfg4.enable || cfg6.enable) {
   
  +    users = {
  +      users.dhcpd = {
  +        isSystemUser = true;
  +        group = "dhcpd";
  +        description = "DHCP daemon user";
  +      };
  +      groups.dhcpd = {};
  +    };
  +
       systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;
   
     };
  
positive.code: 
    imports = [
      (mkRenamedOptionModule [ "services" "dhcpd" ] [ "services" "dhcpd4" ])
    ] ++ flip map [ "4" "6" ] (postfix:
      mkRemovedOptionModule [ "services" "dhcpd${postfix}" "stateDir" ] ''
        The DHCP server state directory is now managed with the systemd's DynamicUser mechanism.
        This means the directory is named after the service (dhcpd${postfix}), created under
        /var/lib/private/ and symlinked to /var/lib/.
      ''
    );
  
    ###### interface
  
  
negative.code:       }
      '';
  
    dhcpdService = postfix: cfg: optionalAttrs cfg.enable {
      "dhcpd${postfix}" = {
        description = "DHCPv${postfix} server";
        wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
  
        preStart = ''
          mkdir -m 755 -p ${cfg.stateDir}
          chown dhcpd:nogroup ${cfg.stateDir}
          touch ${cfg.stateDir}/dhcpd.leases
        '';
  
        serviceConfig =
          let
            configFile = if cfg.configFile != null then cfg.configFile else writeConfig cfg;
            args = [ "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
                     "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
                     "-cf" "${configFile}"
                     "-lf" "${cfg.stateDir}/dhcpd.leases"
                     "-user" "dhcpd" "-group" "nogroup"
                   ] ++ cfg.extraFlags
                     ++ cfg.interfaces;
  
          in {
            ExecStart = concatMapStringsSep " " escapeShellArg args;
            Type = "forking";
            Restart = "always";
            RuntimeDirectory = [ "dhcpd${postfix}" ];
            PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
          };
      };
    };
  
    machineOpts = { ... }: {
  
  