anchor.diff:      boot.initrd = {
         luks = {
           devices =
  -          map (dev: { name = dev.encrypted.label; device = dev.encrypted.blkDev; } ) encDevs;
  +          map (dev: { name = dev.encrypted.label; device = dev.encrypted.blkDev; } ) keylessEncDevs;
           cryptoModules = [ "aes" "sha256" "sha1" "xts" ];
         };
         postMountCommands =
  -        concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.label};\n") keyedEncDevs;
  +        concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n") keyedEncDevs;
       };
     };
   }
  
positive.code:   fileSystems = attrValues config.fileSystems ++ config.swapDevices;
    encDevs = filter (dev: dev.encrypted.enable) fileSystems;
    keyedEncDevs = filter (dev: dev.encrypted.keyFile != null) encDevs;
    isIn = needle: haystack: filter (p: p == needle) haystack != [];
    anyEncrypted =
      fold (j: v: v || j.encrypted.enable) false encDevs;
  
negative.code:       label = mkOption {
          default = null;
          example = "rootfs";
          type = types.uniq (types.nullOr types.str);
          description = "Label of the unlocked encrypted device. Set <literal>fileSystems.&lt;name?&gt;.device</literal> to <literal>/dev/mapper/&lt;label&gt;</literal> to mount the unlocked device.";
        };
  
        keyFile = mkOption {
          default = null;
          example = "/root/.swapkey";
          type = types.nullOr types.str;
          description = "File system location of keyfile. This unlocks the drive after the root has been mounted to <literal>/mnt-root</literal>.";
        };
      };
    };
  