[25.11] etc: support experimental official Nix installer (#1717)

We ran into this issue wherein GitHub's `actions/checkout` would fail
because `git-config` would fail to include additional configuration.

The symptom was:

```
Error: fatal: could not read Username for 'https://github.com': terminal prompts disabled
```

And is caused by `git config --local includeIf.gitdir:/var/lib/github-runners/_work/…`.

Wherein `git` apparently resolves (canonicalizes) the current repository
path which then does not match the argument for `includeIf.gitdir` which
then means the configuration that `actions/checkout` is trying to apply
does not get pulled in, which then prevents git from authenticating with
GitHub and fails the build.

Ngl, gemini 3 found that out for me.

We could prefix `/private` everywhere, but changing the user's home
directory is going to [be tricky], not sure what do to about that.

[be tricky]: https://github.com/nix-darwin/nix-darwin/blob/7e22bf538aa3e0937effcb1cee73d5f1bcc26f79/modules/users/default.nix#L208

(cherry picked from commit a58dd30d2b)

.github/workflows/test.yml

@@ -4,10 +4,10 @@ on:
   merge_group:
   push:
     branches:
-      - master
+      - nix-darwin-25.11
 
 env:
-  NIXPKGS_BRANCH: nixpkgs-unstable
+  NIXPKGS_BRANCH: nixpkgs-25.11-darwin
   NIX_VERSION: 2.24.11
 
 jobs:

README.md

@@ -1,239 +1,3 @@
-[<img src="https://github.com/user-attachments/assets/0e1a77ac-6739-4153-bd24-abd3a5e143f5" width="200px" alt="logo" />](https://github.com/nix-darwin/nix-darwin)
-
 # nix-darwin
 
-[![Test](https://github.com/nix-darwin/nix-darwin/actions/workflows/test.yml/badge.svg)](https://github.com/nix-darwin/nix-darwin/actions/workflows/test.yml)
+This is the 25.11 release branch of nix-darwin. See [the main readme](https://github.com/nix-darwin/nix-darwin#readme) for documentation.
-
-Nix modules for darwin, `/etc/nixos/configuration.nix` for macOS.
-
-This project aims to bring the convenience of a declarative system approach to macOS.
-nix-darwin is built up around [Nixpkgs](https://github.com/NixOS/nixpkgs), quite similar to [NixOS](https://nixos.org/).
-
-## Prerequisites
-
-The only prerequisite is a Nix implementation; both Nix and Lix are supported.
-
-As the official Nix installer does not include an automated uninstaller, and manual uninstallation on macOS is a complex process, we recommend using one of the following installers instead:
-
-* The [Nix installer from Determinate Systems](https://github.com/DeterminateSystems/nix-installer?tab=readme-ov-file#determinate-nix-installer) is only recommended for use with flake-based setups.
-  It can install one of two distributions of Nix:
-
-  * To install the **recommended** vanilla upstream [Nix](https://nixos.org), you will need to explicitly pass the `--prefer-upstream-nix` flag to the installer.
-
-  * When run without the `--prefer-upstream-nix` flag, it will install the [Determinate](https://docs.determinate.systems/) distribution.
-    As Determinate manages the Nix installation itself, you will need to set `nix.enable = false;` in your configuration to disable nix-darwin’s own Nix management.
-    Some nix-darwin functionality that relies on managing the Nix installation, like the `nix.*` options to adjust Nix settings or configure a Linux builder, will be unavailable.
-
-* The [Lix installer](https://lix.systems/install/#on-any-other-linuxmacos-system) supports both flake-based and channel-based setups.
-
-
-
-## Getting started
-
-Despite being an experimental feature in Nix currently, nix-darwin recommends that beginners use flakes to manage their nix-darwin configurations.
-
-<details>
-<summary>Flakes (Recommended for beginners)</summary>
-
-### Step 1. Creating `flake.nix`
-
-<details>
-<summary>Getting started from scratch</summary>
-<p></p>
-
-If you don't have an existing `configuration.nix`, you can run the following commands to generate a basic `flake.nix` inside `/etc/nix-darwin`:
-
-```bash
-sudo mkdir -p /etc/nix-darwin
-sudo chown $(id -nu):$(id -ng) /etc/nix-darwin
-cd /etc/nix-darwin
-
-# To use Nixpkgs unstable:
-nix flake init -t nix-darwin/master
-# To use Nixpkgs 25.05:
-nix flake init -t nix-darwin/nix-darwin-25.05
-
-sed -i '' "s/simple/$(scutil --get LocalHostName)/" flake.nix
-```
-
-Make sure to check if `nixpkgs.hostPlatform` is set to either `x86_64-darwin` for Intel or `aarch64-darwin` for Apple Silicon.
-
-</details>
-
-<details>
-<summary>Migrating from an existing configuration.nix</summary>
-<p></p>
-
-Add the following to `flake.nix` in the same folder as `configuration.nix`:
-
-```nix
-{
-  description = "John's darwin system";
-
-  inputs = {
-    # Use `github:NixOS/nixpkgs/nixpkgs-25.05-darwin` to use Nixpkgs 25.05.
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    # Use `github:nix-darwin/nix-darwin/nix-darwin-25.05` to use Nixpkgs 25.05.
-    nix-darwin.url = "github:nix-darwin/nix-darwin/master";
-    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
-  };
-
-  outputs = inputs@{ self, nix-darwin, nixpkgs }: {
-    darwinConfigurations."Johns-MacBook" = nix-darwin.lib.darwinSystem {
-      modules = [ ./configuration.nix ];
-    };
-  };
-}
-```
-
-Make sure to replace `Johns-MacBook` with your hostname which you can find by running `scutil --get LocalHostName`.
-
-Make sure to set `nixpkgs.hostPlatform` in your `configuration.nix` to either `x86_64-darwin` (Intel) or `aarch64-darwin` (Apple Silicon).
-
-</details>
-
-### Step 2. Installing `nix-darwin`
-
-Unlike NixOS, `nix-darwin` does not have an installer, you can just run `darwin-rebuild switch` to install nix-darwin. As `darwin-rebuild` won't be installed in your `PATH` yet, you can use the following command:
-
-```bash
-# To use Nixpkgs unstable:
-sudo nix run nix-darwin/master#darwin-rebuild -- switch
-# To use Nixpkgs 25.05:
-sudo nix run nix-darwin/nix-darwin-25.05#darwin-rebuild -- switch
-```
-
-### Step 3. Using `nix-darwin`
-
-After installing, you can run `darwin-rebuild` to apply changes to your system:
-
-```bash
-sudo darwin-rebuild switch
-```
-
-#### Using flake inputs
-
-Inputs from the flake can also be passed into `darwinSystem`. These inputs are then
-accessible as an argument `inputs`, similar to `pkgs` and `lib`, inside the configuration.
-
-```nix
-# in flake.nix
-nix-darwin.lib.darwinSystem {
-  modules = [ ./configuration.nix ];
-  specialArgs = { inherit inputs; };
-}
-```
-
-```nix
-# in configuration.nix
-{ pkgs, lib, inputs }:
-# inputs.self, inputs.nix-darwin, and inputs.nixpkgs can be accessed here
-```
-</details>
-
-<details>
-<summary>Channels</summary>
-
-### Step 1. Creating `configuration.nix`
-
-Copy the [simple](./modules/examples/simple.nix) example to `/etc/nix-darwin/configuration.nix`.
-
-### Step 2. Adding `nix-darwin` channel
-
-```bash
-# If you use Nixpkgs unstable (the default):
-sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/master.tar.gz darwin
-# If you use Nixpkgs 25.05:
-sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/nix-darwin-25.05.tar.gz darwin
-
-sudo nix-channel --update
-```
-
-### Step 3. Installing `nix-darwin`
-
-To install `nix-darwin`, you can just run `darwin-rebuild switch` to install nix-darwin. As `darwin-rebuild` won't be installed in your `PATH` yet, you can use the following command:
-
-```bash
-nix-build '<darwin>' -A darwin-rebuild
-sudo ./result/bin/darwin-rebuild switch -I darwin-config=/etc/nix-darwin/configuration.nix
-```
-
-### Step 4. Using `nix-darwin`
-
-After installing, you can run `darwin-rebuild` to apply changes to your system:
-
-```bash
-sudo darwin-rebuild switch
-```
-
-### Step 5. Updating `nix-darwin`
-
-You can update Nixpkgs and `nix-darwin` using the following command:
-
-```bash
-sudo nix-channel --update
-```
-</details>
-
-## Documentation
-
-`darwin-help` will open up a local copy of the reference documentation, it can also be found online [here](https://nix-darwin.github.io/nix-darwin/manual/index.html).
-
-The documentation is also available as manpages by running `man 5 configuration.nix`.
-
-## Uninstalling
-
-To run the latest version of the uninstaller, you can run the following command:
-
-```
-sudo nix --extra-experimental-features "nix-command flakes" run nix-darwin#darwin-uninstaller
-```
-
-If that command doesn't work for you, you can try the locally installed uninstaller:
-
-```
-sudo darwin-uninstaller
-```
-
-## Tests
-
-There are basic tests that run sanity checks for some of the modules,
-you can run them like this:
-
-```bash
-# run all tests
-nix-build release.nix -A tests
-# or just a subset
-nix-build release.nix -A tests.environment-path
-```
-
-## Contributing
-
-Let's make Nix on macOS awesome!
-
-Don't hesitate to contribute modules or open an issue.
-
-To build your configuration with local changes you can run this. This
-flag can also be used to override darwin-config or nixpkgs, for more
-information on the `-I` flag look at the nix-build [manpage](https://nixos.org/manual/nix/stable/command-ref/nix-build.html).
-
-```bash
-sudo darwin-rebuild switch -I darwin=.
-```
-
-If you're adding a module, please add yourself to `meta.maintainers`, for example
-
-```nix
-  meta.maintainers = [
-    lib.maintainers.alice or "alice"
-  ];
-
-  options.services.alicebot = # ...
-```
-
-The `or` operator takes care of graceful degradation when `lib` from Nixpkgs
-goes out of sync.
-
-Feel free to contact us on Matrix if you have questions:
-* **User support:** [#macos:nixos.org](https://matrix.to/#/#macos:nixos.org)
-* **Development discussion:** [#nix-darwin-dev:nixos.org](https://matrix.to/#/#nix-darwin-dev:nixos.org)

doc/known-files/4e8f7cb9b699511f4ba5f9d5f8de1c9f5efb5c607de88faf5f58b8b9cb38edbf

@@ -0,0 +1,7 @@
+
+# Set up Nix only on SSH connections
+# See: https://github.com/DeterminateSystems/nix-installer/pull/714
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ] && [ -n "${SSH_CONNECTION:-}" ] && [ "${SHLVL:-0}" -eq 1 ]; then
+    . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix

doc/known-files/71f7fdc9f6c9e55ca0f2e6f85137037d660b3224a34d59305e8530ca292bc734

@@ -0,0 +1,3 @@
+# Written by https://github.com/NixOS/nix-installer
+# The contents below are based on options specified at installation time.
+

doc/known-files/74ee0ae5ad21a1b101617685fd3d001f74a9466d9d763d92eb75b99cc740db91

@@ -0,0 +1,10 @@
+# Generated by https://github.com/NixOS/nix-installer
+# See `/nix/nix-installer --version` for the version details.
+
+extra-experimental-features = nix-command flakes
+always-allow-substitutes = true
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+
+!include nix.custom.conf

flake.lock

@@ -2,16 +2,16 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747728033,
+        "lastModified": 1764491476,
-        "narHash": "sha256-NnXFQu7g4LnvPIPfJmBuZF7LFy/fey2g2+LCzjQhTUk=",
+        "narHash": "sha256-E4rtgPS7fntINb6fVJ5qQdkhfbZn8pzMYNdmiXqZmCo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2f9173bde1d3fbf1ad26ff6d52f952f9e9da52ea",
+        "rev": "54f09efd2ca0dd5bb9c5fafc89573ab3ac44701d",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixpkgs-25.11-darwin",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,7 +2,7 @@
   description = "A collection of darwin modules";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-25.11-darwin";
   };
 
   outputs = { self, nixpkgs }: let

modules/examples/flake/flake.nix

@@ -2,8 +2,8 @@
   description = "Example nix-darwin system flake";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-25.11-darwin";
-    nix-darwin.url = "github:nix-darwin/nix-darwin/master";
+    nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-25.11";
     nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
   };
 

modules/nix/default.nix

@@ -757,6 +757,7 @@ in
       "6bb8d6b0dd16b44ee793a9b8382dac76c926e4c16ffb8ddd2bb4884d1ca3f811"  # DeterminateSystems Nix installer 0.34.0
       "24797ac05542ff8b52910efc77870faa5f9e3275097227ea4e50c430a5f72916"  # lix-installer 0.17.1 with flakes
       "b027b5cad320b5b8123d9d0db9f815c3f3921596c26dc3c471457098e4d3cc40"  # lix-installer 0.17.1 without flakes
+      "74ee0ae5ad21a1b101617685fd3d001f74a9466d9d763d92eb75b99cc740db91"  # experimental official Nix installer 2.33.3
     ];
 
     environment.etc."nix/registry.json".text = builtins.toJSON {
@@ -881,10 +882,12 @@ in
     # to express that we want it deleted and know only one hash?
     system.activationScripts.checks.text = mkAfter ''
       nixCustomConfKnownSha256Hashes=(
-        # v0.33.0
+        # DetSys v0.33.0
         6787fade1cf934f82db554e78e1fc788705c2c5257fddf9b59bdd963ca6fec63
-        # v0.34.0
+        # DetSys v0.34.0
         3bd68ef979a42070a44f8d82c205cfd8e8cca425d91253ec2c10a88179bb34aa
+        # Nix 2.33.3
+        71f7fdc9f6c9e55ca0f2e6f85137037d660b3224a34d59305e8530ca292bc734
       )
       if [[ -e /etc/nix/nix.custom.conf ]]; then
         nixCustomConfSha256Output=$(shasum -a 256 /etc/nix/nix.custom.conf)

modules/nix/nixpkgs.nix

@@ -135,7 +135,7 @@ in
       type = configType;
       description = ''
         Global configuration for Nixpkgs.
-        The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig).
+        The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/stable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/stable/#chap-packageconfig).
 
         Ignored when {option}`nixpkgs.pkgs` is set.
       '';

modules/programs/zsh/default.nix

@@ -260,6 +260,7 @@ in
 
     environment.etc."zshenv".knownSha256Hashes = [
       "d07015be6875f134976fce84c6c7a77b512079c1c5f9594dfa65c70b7968b65f"  # DeterminateSystems installer
+      "4e8f7cb9b699511f4ba5f9d5f8de1c9f5efb5c607de88faf5f58b8b9cb38edbf"  # experimental official Nix installer 2.33.3
     ];
 
   };

modules/services/github-runner/service.nix

@@ -8,7 +8,7 @@ let
   mkSvcName = name: "github-runner-${name}";
   mkStateDir = cfg: "/var/lib/github-runners/${cfg.name}";
   mkLogDir = cfg: "/var/log/github-runners/${cfg.name}";
-  mkWorkDir = cfg: if (cfg.workDir != null) then cfg.workDir else "/var/lib/github-runners/_work/${cfg.name}";
+  mkWorkDir = cfg: if (cfg.workDir != null) then cfg.workDir else "/private/var/lib/github-runners/_work/${cfg.name}";
 in
 {
   config.assertions = flatten (

modules/system/checks.nix

@@ -10,10 +10,9 @@ let
 
   macOSVersion = ''
     IFS=. read -ra osVersion <<<"$(sw_vers -productVersion)"
-    if (( osVersion[0] < 11 || (osVersion[0] == 11 && osVersion[1] < 3) )); then
+    if (( osVersion[0] < 14 )); then
-      printf >&2 '\e[1;31merror: macOS version is less than 11.3, aborting activation\e[0m\n'
+      printf >&2 '\e[1;31merror: macOS version is less than 14.0, aborting activation\e[0m\n'
-      printf >&2 'Nixpkgs 25.05 requires macOS Big Sur 11.3 or newer, and 25.11 will\n'
+      printf >&2 'Nixpkgs 25.11 requires macOS Sonoma 14.0 or newer.\n'
-      printf >&2 'require macOS Sonoma 14.\n'
       printf >&2 '\n'
       printf >&2 'For more information on your options going forward, see the 25.05\n'
       printf >&2 'release notes:\n'

version.json

@@ -1,4 +1,4 @@
 {
   "release": "25.11",
-  "isReleaseBranch": false
+  "isReleaseBranch": true
 }