```suggestion                ${optionalString cfg.enableFscrypt                  "auth optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so"}                ${optionalString cfg.pamMount                  "auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so"}  ```    Nitpick but let's keep the order consistent with above.