I managed to get Dual-Stack-Lite running under NixOS. If you have any ideas for making it prettier your welcome. Especially dhcpcd is much more in the way than helpful.

https://git.clerie.de/clerie/nixfiles/commit/f3629c2653f311398bfa5fad876b2744ffc66b40

Wireless chip is MT7922. And here's my wireless.nix:

{
  config,
  lib,
  pkgs,
  ...
}: {
    boot.extraModprobeConfig = ''
        options cfg80211 ieee80211_regdom="DE"
    '';

    hardware.wirelessRegulatoryDatabase = true;

    services.hostapd = {
        enable = true;

        radios."wlp5s0" = {
            settings.ieee80211h = lib.mkForce false;

            wifi5 = {
                enable = true;
                operatingChannelWidth = "20or40";
                require = true;
            };

            countryCode = "DE";
            channel = 36;
            band = "5g";

            networks.wlp5s0 = {
                logLevel = 1;
                ssid = "SsidName";
                authentication = {
                    mode = "wpa3-sae";
                    saePasswords = [
                        { password = "Password"; }
                    ];
                    enableRecommendedPairwiseCiphers = true;
                };
                settings = {
                    bridge = "br0";
                    beacon_int = 50;
                };
            };
        };
    };
}

Issues:

1. Only Linux and MacOS clients can connect to this network. iOS 18 and Windows 11, both obviously supporting Wifi5, cannot connect to it - it is visible in the list of networks, but both fail upon connection try.
2. On Linux and MacOS, it takes some time for network to become visible in the list. On Linux via nmcli dev wifi list it may take even a minute or two for it to show up. This is not a recurring issue, but it happens about 1/3 of all the times.
3. I could not switch operatingChannelWidth = "20or40"; to 80 - I can apply the option, the system rebuilds and boots fine, network is visible and allows to connect to, there is WAN, but network itself is still 20 MHz (not even 40), as confirmed by both cat /run/hostapd/wlp5s0.hostapd.conf on router (output below) and wavemon on Linux client (reports width: 20 MHz). Please also mind ht_capab and vht_capab (looks suspisious to me).

[root@nixos:~]# cat /run/hostapd/wlp5s0.hostapd.conf
# Radio base configuration: wlp5s0
################################

channel=36
country_code=DE
driver=nl80211
ht_capab=[HT40][SHORT-GI-20][SHORT-GI-40]
hw_mode=a
ieee80211ac=1
ieee80211d=1
ieee80211h=0
ieee80211n=1
noscan=0
require_ht=0
require_vht=1
vht_capab=
vht_oper_chwidth=0


# BSS 0: wlp5s0
################################

interface=wlp5s0
ap_isolate=0
auth_algs=1
beacon_int=50
bridge=br0
ctrl_interface=/run/hostapd
ctrl_interface_group=wheel
ieee80211w=1
ignore_broadcast_ssid=0
logger_stdout=-1
logger_stdout_level=1
logger_syslog=-1
logger_syslog_level=1
macaddr_acl=0
rsn_pairwise=CCMP GCMP GCMP-256
sae_pwe=2
sae_require_mfp=1
ssid=SsidName
transition_disable=0x01
utf8_ssid=1
wmm_enabled=1
wpa=2
wpa_key_mgmt=SAE
wpa_pairwise=CCMP GCMP GCMP-256
sae_password=password