{ pkgs, lib, ... }:
let
  cryptsetup' = pkgs.cryptsetup.overrideAttrs (old: {
    patches = (old.patches or []) ++ [
      ./relative-token-path.patch
    ];
  });

  # https://github.com/NixOS/nixpkgs/pull/184510
  libfido2' = pkgs.libfido2.overrideAttrs (old: {
    propagatedBuildInputs = (old.propagatedBuildInputs or []) ++ [
      pkgs.openssl
    ];
  });

  patchSystemd = systemd: (systemd.override {
    cryptsetup = cryptsetup';
    libfido2 = libfido2';
  }).overrideAttrs (old: {
    nativeBuildInputs = (old.nativeBuildInputs or []) ++ [
      pkgs.makeBinaryWrapper
    ];

    postFixup = (old.postFixup or "") + ''
      for f in lib/systemd/systemd-cryptsetup bin/systemd-cryptenroll; do
        # This needs to be in LD_LIBRARY_PATH because rpath on a binary is not propagated to libraries using dlopen, in this case `libcryptsetup.so`
        wrapProgram $out/$f --prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib/cryptsetup
      done
    '';
  });

  systemdStage1' = patchSystemd pkgs.systemdStage1;
in {
  boot.initrd.systemd = {
    enable = true;
    package = systemdStage1';
    emergencyAccess = true;
    initrdBin = with pkgs; [ gnugrep cryptsetup strace ]; # for debugging only

    storePaths = [
      # FIXME: Add to PR in a clean way
      "${systemdStage1'}/lib/systemd/.systemd-cryptsetup-wrapped"
      "${systemdStage1'}/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so"
      "${systemdStage1'}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
      libfido2'
    ];
  };
}