anchor.diff:        default = pkgs.github-runner;
         defaultText = literalExpression "pkgs.github-runner";
       };
  +
  +    ephemeral = mkOption {
  +      type = types.bool;
  +      description = lib.mdDoc ''
  +        If enabled, causes the following behavior:
  +
  +        - Passes the `--ephemeral` flag to the runner configuration script
  +        - De-registers and stops the runner with GitHub after it has processed one job
  +        - On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
  +        - Restarts the service after its successful exit
  +        - On start, wipes the state directory and configures a new runner
  +
  +        You should only enable this option if `tokenFile` points to a file which contains a
  +        personal access token (PAT). If you're using the option with a registration token, restarting the
  +        service will fail as soon as the registration token expired.
  +      '';
  +      default = false;
  +    };
     };
   
     config = mkIf cfg.enable {
  
positive.code:             ];
              unconfigureRunner = writeScript "unconfigure" ''
                differs=
                # Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
                ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
                # Also trigger a registration if the token content changed
                ${pkgs.diffutils}/bin/diff -q \
                  "$STATE_DIRECTORY"/${currentConfigTokenFilename} \
                  ${escapeShellArg cfg.tokenFile} \
                  >/dev/null 2>&1 || differs=1
  
                if [[ -n "$differs" ]]; then
                  echo "Config has changed, removing old runner state."
                  echo "The old runner will still appear in the GitHub Actions UI." \
                    "You have to remove it manually."
                  find "$STATE_DIRECTORY/" -mindepth 1 -delete
  
  
negative.code:             configureRunner
              setupRuntimeDir
            ];
  
          # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
          # to trigger a fresh registration.
          Restart = if cfg.ephemeral then "on-success" else "no";
  
          # Contains _diag
          LogsDirectory = [ systemdDir ];
  