anchor.diff:        default = [];
         example = literalExample "[ pkgs.kernelPatches.ubuntu_fan_4_4 ]";
         description = "A list of additional patches to apply to the kernel.";
  +    };
  +
  +    boot.kernel.randstructSeed = mkOption {
  +      type = types.str;
  +      default = "";
  +      example = "my secret seed";
  +      description = ''
  +        Provides a custom seed for the <varname>RANDSTRUCT</varname> security
  +        option of the Linux kernel. Note that <varname>RANDSTRUCT</varname> is
  +        only enabled in NixOS hardened kernels. Using a custom seed requires
  +        building the kernel and dependent packages locally, since this
  +        customization happens at build time.
  +      '';
       };
   
       boot.kernelParams = mkOption {
  
positive.code:       # !!! Should this really be needed?
        (isYes "MODULES")
        (isYes "BINFMT_ELF")
      ];
  
      # nixpkgs kernels are assumed to have all required features
      assertions = if config.boot.kernelPackages.kernel ? features then [] else
  
negative.code:       default = pkgs.linuxPackages;
        apply = kernelPackages: kernelPackages.extend (self: super: {
          kernel = super.kernel.override {
            inherit randstructSeed;
            kernelPatches = super.kernel.kernelPatches ++ kernelPatches;
            features = lib.recursiveUpdate super.kernel.features features;
          };
  