anchor.diff:             + optionalString dev.bypassWorkqueues " --perf-no_read_workqueue --perf-no_write_workqueue"
              + optionalString (dev.header != null) " --header=${dev.header}";
       cschange = "cryptsetup luksChangeKey ${dev.device} ${optionalString (dev.header != null) "--header=${dev.header}"}";
  +    fido2luksCredentials = dev.fido2.credentials ++ optional (dev.fido2.credential != null) dev.fido2.credential;
     in ''
       # Wait for luksRoot (and optionally keyFile and/or header) to appear, e.g.
       # if on a USB drive.
  
positive.code:           echo "Please move your mouse to create needed randomness."
          ''}
            echo "Waiting for your FIDO2 device..."
            fido2luks open${optionalString dev.allowDiscards " --allow-discards"} ${dev.device} ${dev.name} ${dev.fido2.credential} --await-dev ${toString dev.fido2.gracePeriod} --salt string:$passphrase
          if [ $? -ne 0 ]; then
            echo "No FIDO2 key found, falling back to normal open procedure"
            open_normally
  
negative.code:               example = "f1d00200d8dc783f7fb1e10ace8da27f8312d72692abfca2f7e4960a73f48e82e1f7571f6ebfcee9fb434f9886ccc8fcc52a6614d8d2";
                type = types.nullOr types.str;
                description = lib.mdDoc "The FIDO2 credential ID.";
              };
  
              credentials = mkOption {
                default = [];
                example = [ "f1d00200d8dc783f7fb1e10ace8da27f8312d72692abfca2f7e4960a73f48e82e1f7571f6ebfcee9fb434f9886ccc8fcc52a6614d8d2" ];
                type = types.listOf types.str;
                description = lib.mdDoc ''
                  List of FIDO2 credential IDs.
  
                  Use this if you have multiple FIDO2 keys you want to use for the same luks device.
                '';
              };
  
              gracePeriod = mkOption {
  