maltego = pkgs.maltego.overrideAttrs (prev: {
       buildInputs = (prev.buildInputs or []) ++ [ pkgs.makeWrapper ];
       postInstall = (prev.postInstall or "") + ''
            wrapProgram $out/bin/maltego \
              --run 'mkdir -p $HOME/.maltego/v${prev.version}/etc && : > $HOME/.maltego/v${prev.version}/etc/maltego.conf'
       '';
});

--run 'mkdir -p $HOME/.maltego/v${prev.version}/etc && [ -e $HOME/.maltego/v${prev.version}/etc/maltego.conf ] || : > $HOME/.maltego/v${prev.version}/etc/maltego.conf'

yeah, there's two things..

1. I have a test box in my fleet that doesn't use lix, partly just to catch cases where something diverges, mostly because I just forgot to add the lix module and discovered that when something broke (one of the experimental features) as a result and so decided to keep it.
2. For all the other hosts, I don't want cppnix there at all, but it is pulled in somewhere and I just haven't bothered chasing down where

In reply to @sofiedotcafe:matrix.org
and make the original somehow not allowed

what I ended up doing, more or less:

{
  nixpkgs.overlays = [
    (f: p: {
      nix = f.lixPackageSets.lix_2_93.lix;

      nixVersions = {
        latest = f.nix;
        stable = f.nix;
      };
    })
  ];

  system.forbiddenDependenciesRegexes = [ "^/nix/store/[a-z0-9]+-nix-[0-9.]+.*" ];
}

of course this will break anything that relies on the c api :|