Set merge + mkIf always surprises me

nixos/modules/programs/shadow.nix

···
       chfn.source      = "${pkgs.shadow.out}/bin/chfn";
       newuidmap.source = "${pkgs.shadow.out}/bin/newuidmap";
       newgidmap.source = "${pkgs.shadow.out}/bin/newgidmap";
-    } // (lib.mkIf config.users.mutableUsers {
+    } // (if config.users.mutableUsers then {
       passwd.source    = "${pkgs.shadow.out}/bin/passwd";
       sg.source        = "${pkgs.shadow.out}/bin/sg";
       newgrp.source    = "${pkgs.shadow.out}/bin/newgrp";
-    });
+    } else {});
   };
 }

nixos/modules/security/pam.nix

···
         owner = "root";
         setuid = true;
       };
-    } // (mkIf config.security.pam.enableEcryptfs {
+    } // (if config.security.pam.enableEcryptfs then {
       "mount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";
        "umount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private";
-    });
+    } else {});
 
     environment.etc =
       mapAttrsToList (n: v: makePAMService v) config.security.pam.services;

nixos/modules/security/wrappers/default.nix

···
 
   ###### implementation
   config = {
+
+    security.wrappers.fusermount.source = "${pkgs.fuse}/bin/fusermount";
+
     # Make sure our wrapperDir exports to the PATH env variable when
     # initializing the shell
     environment.extraInit = ''