diff --git a/nixos/modules/services/networking/kea.nix b/nixos/modules/services/networking/kea.nix
index 6e0af62425a4..6f815659f567 100644
--- a/nixos/modules/services/networking/kea.nix
+++ b/nixos/modules/services/networking/kea.nix
@@ -272,12 +272,13 @@ in
       };
 
       commonServiceConfig = {
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        ExecStartPre = "${lib.getExe' pkgs.coreutils "chmod"} 0750 /run/kea";
+        ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
         DynamicUser = true;
         User = "kea";
         ConfigurationDirectory = "kea";
         RuntimeDirectory = "kea";
-        RuntimeDirectoryMode = "750";
+        RuntimeDirectoryMode = "0750";
         RuntimeDirectoryPreserve = true;
         StateDirectory = "kea";
         UMask = "0077";

Hey all, hoping someone might be able to help with an issue I'm hitting configuring VLANs. Use case is pretty simple, the only connection should be over the vlan, no untagged traffic or IP assigned. Following the docs (https://nixos.wiki/wiki/Systemd-networkd#VLAN) I came up with this systemd-networkd config, but pinging even local addresses returns unreachable. Any thoughts, or ideas on how to debug?

systemd.network = {
    enable = true;

    netdevs = {
      "20-vlan30" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "vlan30";
        };
        vlanConfig.Id = 30;
      };
    };

    networks = {
      "30-enp0s20f0u1u2" = {
        matchConfig.Name = "enp0s20f0u1u2";
        vlan = [ "vlan30" ];
        networkConfig.LinkLocalAddressing = "no";
        linkConfig.RequiredForOnline = "carrier";
      };
      "40-vlan30" = {
        matchConfig.Name = "vlan30";
        address = [ "192.168.30.7/24" ];
        routes = [
          { Gateway = "192.168.30.1"; }
        ];
        linkConfig.RequiredForOnline = "routable";
      };
    };
  };

And here's the output of a couple commands to show the state, LMK if there are any other commands that would be helpful

$ networkctl
IDX LINK          TYPE     OPERATIONAL SETUP
  1 lo            loopback carrier     unmanaged
  2 enp0s20f0u1u2 ether    carrier     configured
  3 vlan30        vlan     routable    configured

3 links listed.

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: enp0s20f0u1u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 1c:bf:ce:a7:84:b8 brd ff:ff:ff:ff:ff:ff
    altname enx1cbfcea784b8
3: vlan30@enp0s20f0u1u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 1c:bf:ce:a7:84:b8 brd ff:ff:ff:ff:ff:ff
    inet 192.168.30.7/24 brd 192.168.30.255 scope global vlan30
       valid_lft forever preferred_lft forever
    inet6 fe80::1ebf:ceff:fea7:84b8/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever