NixOS Releases

Updated

September 12, 2026

NixOS 23.05 — Stoat

Area	Change
systemd	253; `systemd-oomd` enabled by default on desktop profiles.
Python	3.11 is the default interpreter; `python3` symlink resolves to `python3.11`.
Nix	Ships Nix 2.13; flake support via `nix.settings.experimental-features` is opt-in stable.
Module system	`config.system.stateVersion` warning added for stale values.
Security	`services.fail2ban` updated to 1.0; new `ignoreIP` list option.

Key feature — enabling flakes on a Stoat workstation

Save as configuration.nix:

# configuration.nix
{ pkgs, ... }:
{
  # Enable the two features that make flakes and the new nix
  # command available on every desk workstation running 23.05.
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  # Pin the channel so every workstation evaluates identically.
  nix.registry.nixpkgs.flake = import <nixpkgs> { };

  environment.systemPackages = [ pkgs.git ];
}

Run:

sudo nixos-rebuild switch --flake /etc/nixos#workstation

Output:

building the system configuration...
activating the configuration...
setting up /etc...
the following new units were started: nix-daemon.service

NixOS 23.11 — Tapir

Area	Change
GNOME	45; Mutter gains explicit sync support for tear-free rendering on variable-refresh monitors.
PHP	8.2 is default; `services.phpfpm` pools now set `pm.max_spare_servers` automatically.
Kernel	6.1 LTS; default for most hardware profiles.
`services.avahi`	`openFirewall` now defaults to `false`; must be set explicitly.
Nix	Ships Nix 2.18.

Key feature — explicit Avahi firewall declaration

Save as configuration.nix:

# configuration.nix
{ ... }:
{
  # 23.11 changed the default: openFirewall is now false.
  # Desk printers and mDNS service discovery need this set
  # explicitly or discovery will silently fail.
  services.avahi = {
    enable = true;
    nssmdns4 = true;   # allow getaddrinfo to resolve .local
    openFirewall = true;
  };
}

Run:

sudo nixos-rebuild switch --flake /etc/nixos#workstation

Output:

activating the configuration...
setting up /etc...
reloading the following units: firewall.service

NixOS 24.05 — Uakari

Area	Change
systemd	255; `systemd-boot` gains UKI (Unified Kernel Image) signing support.
Python	3.12 is default; `python3.11` still available as explicit attribute.
Nix	Ships Nix 2.22 — `nix build --rebuild` and stable `nix copy` available out of the box.
`system.etc.overlay`	Experimental option; mounts `/etc` as an overlay for impermanence workflows.
`boot.initrd.systemd`	Available as an opt-in Stage-1; not the channel default yet (that lands in 26.05).
`services.postgresql`	`enableJIT` now defaults to `true` for 14+.

Key feature — opt-in systemd initrd (pre-26.05)

Save as configuration.nix:

# configuration.nix
{ ... }:
{
  # On 24.05 this is opt-in. 26.05 flips the default to true and
  # deprecates the scripted Stage 1. Prefer the systemd path early
  # if the desk host uses LUKS / TPM2 unlock.
  boot.initrd.systemd.enable = true;
  boot.initrd.luks.devices."cryptroot" = {
    device = "/dev/disk/by-uuid/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
    allowDiscards = true;
  };

  # Pin Nix to 2.22 features in this release.
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];
}

Run:

sudo nixos-rebuild boot --flake /etc/nixos#desk-build

Output:

building the system configuration...
updating GRUB 2 menu...
Done. The new configuration will be used when the machine is rebooted.

NixOS 24.11 — Vicuna

Area	Change
GNOME	47; default font is now Cantarell 11; GNOME Color Manager updated.
Kernel	6.6 LTS; `amdgpu` gains firmware for RDNA 3.5 integrated graphics.
Nix	Ships Nix 2.24 — `nix path-info --json`, `nix store diff-closures` stable.
`services.openssh.settings`	New sub-options: `MaxSessions`, `PermitUserEnvironment`, `AllowGroups`.
`security.apparmor`	`enableCache` option added; profile compile cache speeds boot on profile-heavy machines.
Python	3.12 remains default; 3.13 available as `python313`.

Key feature — locked-down SSH with services.openssh.settings

Save as configuration.nix:

# configuration.nix
{ ... }:
{
  # 24.11 exposes AllowGroups directly in the settings attrset,
  # eliminating the need for extraConfig string concatenation.
  services.openssh = {
    enable = true;
    settings = {
      PasswordAuthentication = false;
      PermitRootLogin = "no";
      MaxSessions = 4;
      AllowGroups = [ "ops" "developers" ];
    };
  };

  # AppArmor with compile cache — useful on desk machines that
  # load many profiles at boot.
  security.apparmor = {
    enable = true;
    enableCache = true;
  };
}

Run:

sudo nixos-rebuild switch --flake /etc/nixos#workstation

Output:

activating the configuration...
reloading the following units: sshd.service apparmor.service