anchor.diff:      # Warning: Do NOT replace with tmpfs!
       mkdir -p /crypt-ramfs
       mount -t ramfs none /crypt-ramfs
  +
  +    # For Yubikey salt storage
  +    mkdir -p /crypt-storage
     '';
   
     postCommands = ''
  +    umount /crypt-storage 2>/dev/null
       umount /crypt-ramfs 2>/dev/null
     '';
   
  
positive.code:                     description = "The filesystem of the unencrypted device.";
                    };
  
                    mountPoint = mkOption {
                      default = "/crypt-storage";
                      type = types.str;
                      description = "Path where the unencrypted device will be mounted during early boot.";
                    };
  
                    path = mkOption {
                      default = "/crypt-storage/default";
                      type = types.str;
  
negative.code:             new_k_luks="$(echo | pbkdf2-sha512 ${toString yubikey.keyLength} $new_iterations $new_response | rbtohex)"
          fi
  
          echo -n "$new_k_luks" | hextorb > /crypt-ramfs/new_key
          echo -n "$k_luks" | hextorb | ${cschange} --key-file=- /crypt-ramfs/new_key
  
          if [ $? == 0 ]; then
              echo -ne "$new_salt\n$new_iterations" > /crypt-storage${yubikey.storage.path}
          else
              echo "Warning: Could not update LUKS key, current challenge persists!"
          fi
  
          rm -f /crypt-ramfs/new_key
          umount /crypt-storage
      }
  
      open_yubikey() {
  