anchor.diff:    cfg = config.networking.wireless;
     opt = options.networking.wireless;
   
  +  wpa3Protocols = [ "SAE" "FT-SAE" ];
  +  hasWPA3 = opts: !mutuallyExclusive opts.authProtocols wpa3Protocols;
  +
  +  # Gives a WPA3 network higher priority
  +  increaseWPA3Priority = opts:
  +    opts // optionalAttrs (hasWPA3 opts)
  +      { priority = if opts.priority == null
  +                     then 1
  +                     else opts.priority + 1;
  +      };
  +
  +  # Creates a WPA2 fallback network
  +  mkWPA2Fallback = opts:
  +    opts // { authProtocols = subtractLists wpa3Protocols opts.authProtocols; };
  +
  +  # Networks attrset as a list
  +  networkList = mapAttrsToList (ssid: opts: opts // { inherit ssid; })
  +                cfg.networks;
  +
  +  # List of all networks (normal + generated fallbacks)
  +  allNetworks =
  +    if cfg.fallbackToWPA2
  +      then map increaseWPA3Priority networkList
  +           ++ map mkWPA2Fallback (filter hasWPA3 networkList)
  +      else networkList;
  +
     # Content of wpa_supplicant.conf
     generatedConfig = concatStringsSep "\n" (
  -    (mapAttrsToList mkNetwork cfg.networks)
  +    (map mkNetwork allNetworks)
       ++ optional cfg.userControlled.enable (concatStringsSep "\n"
         [ "ctrl_interface=/run/wpa_supplicant"
           "ctrl_interface_group=${cfg.userControlled.group}"
  
positive.code:       else opts.pskRaw;
  
      options = [
        "ssid=${quote ssid}"
        (if pskString != null || opts.auth != null
          then "key_mgmt=${concatStringsSep " " opts.authProtocols}"
          else "key_mgmt=NONE")
  
negative.code:   finalConfig = ''"$RUNTIME_DIRECTORY"/wpa_supplicant.conf'';
  
    # Creates a network block for wpa_supplicant.conf
    mkNetwork = opts:
    let
      quote = x: ''"${x}"'';
      indent = x: "  " + x;
  