anchor.diff:          StateDirectory = [ systemdDir ];
           StateDirectoryMode = "0700";
           WorkingDirectory = runtimeDir;
  +
  +        InaccessiblePaths = [
  +          # Token file path given in the configuration
  +          cfg.tokenFile
  +          # Token file in the state directory
  +          "${stateDir}/${currentConfigTokenFilename}"
  +        ];
   
           # By default, use a dynamically allocated user
           DynamicUser = true;
  
positive.code:             currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
              runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" ] cfg;
              newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
              currentConfigTokenFilename = ".current-token";
              newConfigTokenFilename = ".new-token";
              runnerCredFiles = [
                ".credentials"
                ".credentials_rsaparams"
                ".runner"
              ];
              ownConfigTokens = writeScript "own-config-tokens" ''
                # Copy current and new token file to runtime dir and make it accessible to the service user
                cp ${escapeShellArg cfg.tokenFile} "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
                chmod 600 "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
                chown "$USER" "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
  
                if [[ -e "$STATE_DIRECTORY/${currentConfigTokenFilename}" ]]; then
                  cp "$STATE_DIRECTORY/${currentConfigTokenFilename}" "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
                  chmod 600 "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
                  chown "$USER" "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
                fi
              '';
              disownConfigTokens = writeScript "disown-config-tokens" ''
                # Make the token inaccessible to the runner service user
                chmod 600 "$STATE_DIRECTORY/${currentConfigTokenFilename}"
                chown root:root "$STATE_DIRECTORY/${currentConfigTokenFilename}"
              '';
              unconfigureRunner = writeScript "unconfigure" ''
                differs=
                # Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
                ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
                # Also trigger a registration if the token content changed
                ${pkgs.diffutils}/bin/diff -q \
                  "$RUNTIME_DIRECTORY"/{${currentConfigTokenFilename},${newConfigTokenFilename}} \
                  >/dev/null 2>&1 || differs=1
  
                if [[ -n "$differs" ]]; then
  
negative.code:             '';
            in
            map (x: "${x} ${escapeShellArgs [ stateDir runtimeDir logsDir ]}") [
              "+${unconfigureRunner}" # runs as root
              configureRunner
              setupRuntimeDir
            ];
  
  