Also Guix switch challenge is incredible from a security perspective: https://www.gnu.org/software/guix/manual/html_node/Invoking-...
Nix should take those things back. Overall, it's a great package manager.