anchor.diff:            Whether to periodically scan for (better) networks when the signal of
             the current one is low. This will make roaming between access points
             faster, but will consume more power.
  +        '';
  +      };
  +
  +      fallbackToWPA2 = mkOption {
  +        type = types.bool;
  +        default = true;
  +        description = ''
  +          Whether to fall back to WPA2 authentication protocols if WPA3 failed.
  +          This allows old wireless cards (that lack recent features required by
  +          WPA3) to connect to mixed WPA2/WPA3 access points.
  +
  +          To avoid possible downgrade attacks, disable this options.
           '';
         };
   
  
positive.code:       else opts.pskRaw;
  
      options = [
        "ssid=${quote ssid}"
        (if pskString != null || opts.auth != null
          then "key_mgmt=${concatStringsSep " " opts.authProtocols}"
          else "key_mgmt=NONE")
  
negative.code:   cfg = config.networking.wireless;
    opt = options.networking.wireless;
  
    wpa3Protocols = [ "SAE" "FT-SAE" ];
    hasWPA3 = opts: !mutuallyExclusive opts.authProtocols wpa3Protocols;
  
    # Gives a WPA3 network higher priority
    increaseWPA3Priority = opts:
      opts // optionalAttrs (hasWPA3 opts)
        { priority = if opts.priority == null
                       then 1
                       else opts.priority + 1;
        };
  
    # Creates a WPA2 fallback network
    mkWPA2Fallback = opts:
      opts // { authProtocols = subtractLists wpa3Protocols opts.authProtocols; };
  
    # Networks attrset as a list
    networkList = mapAttrsToList (ssid: opts: opts // { inherit ssid; })
                  cfg.networks;
  
    # List of all networks (normal + generated fallbacks)
    allNetworks =
      if cfg.fallbackToWPA2
        then map increaseWPA3Priority networkList
             ++ map mkWPA2Fallback (filter hasWPA3 networkList)
        else networkList;
  
    # Content of wpa_supplicant.conf
    generatedConfig = concatStringsSep "\n" (
      (map mkNetwork allNetworks)
      ++ optional cfg.userControlled.enable (concatStringsSep "\n"
        [ "ctrl_interface=/run/wpa_supplicant"
          "ctrl_interface_group=${cfg.userControlled.group}"
  