interesting ...

# sudo darwin-rebuild switch --flake ~/.config/nix --show-trace
...
error: derivation '/nix/store/7ihkwpcdsk41sk0sk3fiy88xcpjm59yx-nodejs-slim-22.22.1.drv' specifies a sandbox profile, but this is only allowed when 'sandbox' is 'relaxed'

in the derivation, it shows ...

      "__sandboxProfile": "(allow file-read*\n  (literal \"/Library/Keychains/System.keychain\")\n  (literal \"/private/var/db/mds/system/mdsDirectory.db\")\n  (literal \"/private/var/db/mds/system/mdsObject.db\"))\n\n; Allow files written by Module Directory Services (MDS), which is used\n; by Security.framework: https://apple.stackexchange.com/a/411476\n; These rules are based on the system sandbox profiles found in\n; /System/Library/Sandbox/Profiles.\n(allow file-write*\n  (regex #\"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\\.db$\")\n  (regex #\"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\\.db_?$\")\n  (regex #\"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\\.lock$\"))\n\n(allow mach-lookup\n  (global-name \"com.apple.FSEvents\")\n  (global-name \"com.apple.SecurityServer\")\n  (global-name \"com.apple.system.opendirectoryd.membership\"))\n",

Is this what it's complaining about?