diff --git a/lib/generators.nix b/lib/generators.nix
index 376aa4081bf4f4..352644df0431e8 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -606,12 +606,12 @@ in rec {
 
   in
   # TODO: As discussed in #356502, deprecated functionality should be removed sometime after 25.11.
-  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated"
-  ''<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-${expr "" v}
-</plist>'';
+  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated" ''
+  <?xml version="1.0" encoding="UTF-8"?>
+  <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+  <plist version="1.0">
+  ${expr "" v}
+  </plist>'';
 
   /**
     Translate a simple Nix expression to Dhall notation.
diff --git a/lib/lists.nix b/lib/lists.nix
index ca436d7a9c94b5..4a325bb307afa8 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -1748,8 +1748,8 @@ rec {
     ```
     :::
   */
-  crossLists = warn
-    ''lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
+  crossLists = warn ''
+    lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
 
     For example, the following function call:
 
diff --git a/nixos/modules/hardware/wooting.nix b/nixos/modules/hardware/wooting.nix
index 101bd2d32010e9..d42ca2f4899abc 100644
--- a/nixos/modules/hardware/wooting.nix
+++ b/nixos/modules/hardware/wooting.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 {
-  options.hardware.wooting.enable = lib.mkEnableOption ''support for Wooting keyboards.
+  options.hardware.wooting.enable = lib.mkEnableOption ''
+    support for Wooting keyboards.
     Note that users must be in the "input" group for udev rules to apply'';
 
   config = lib.mkIf config.hardware.wooting.enable {
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index a9a4564ad86b35..e48a332f49eae9 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -106,7 +106,7 @@ let
       path =  [
         config.services.borgbackup.package pkgs.openssh
       ];
-      script = "exec " + lib.optionalString cfg.inhibitsSleep ''\
+      script = "exec " + lib.optionalString cfg.inhibitsSleep ''
         ${pkgs.systemd}/bin/systemd-inhibit \
             --who="borgbackup" \
             --what="sleep" \
@@ -183,7 +183,7 @@ let
       mode != "none" -> passCommand != null || passphrase != null;
     message =
       "passCommand or passphrase has to be specified because"
-      + '' borgbackup.jobs.${name}.encryption != "none"'';
+      + " borgbackup.jobs.${name}.encryption != \"none\"";
   };
 
   mkRepoService = name: cfg:
diff --git a/nixos/modules/services/cluster/kubernetes/apiserver.nix b/nixos/modules/services/cluster/kubernetes/apiserver.nix
index e05bcb37e819f0..e40893f5aed8d4 100644
--- a/nixos/modules/services/cluster/kubernetes/apiserver.nix
+++ b/nixos/modules/services/cluster/kubernetes/apiserver.nix
@@ -320,7 +320,8 @@ in
           after = [ "network.target" ];
           serviceConfig = {
             Slice = "kubernetes.slice";
-            ExecStart = ''${top.package}/bin/kube-apiserver \
+            ExecStart = ''
+              ${top.package}/bin/kube-apiserver \
               --allow-privileged=${lib.boolToString cfg.allowPrivileged} \
               --authorization-mode=${lib.concatStringsSep "," cfg.authorizationMode} \
                 ${lib.optionalString (lib.elem "ABAC" cfg.authorizationMode)
diff --git a/nixos/modules/services/cluster/kubernetes/proxy.nix b/nixos/modules/services/cluster/kubernetes/proxy.nix
index 2e3fdc87b4396a..7cf2591338d908 100644
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@@ -65,7 +65,8 @@ in
       path = with pkgs; [ iptables conntrack-tools ];
       serviceConfig = {
         Slice = "kubernetes.slice";
-        ExecStart = ''${top.package}/bin/kube-proxy \
+        ExecStart = ''
+          ${top.package}/bin/kube-proxy \
           --bind-address=${cfg.bindAddress} \
           ${optionalString (top.clusterCidr!=null)
             "--cluster-cidr=${top.clusterCidr}"} \
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 31532646f8edc5..b542e94bf80d30 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -211,7 +211,8 @@ in {
             masterAuth = lib.mkOption {
               type = with types; nullOr str;
               default = null;
-              description = ''If the master is password protected (using the requirePass configuration)
+              description = ''
+              If the master is password protected (using the requirePass configuration)
               it is possible to tell the slave to authenticate before starting the replication synchronization
               process, otherwise the master will refuse the slave request.
               (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
diff --git a/nixos/modules/services/desktops/pipewire/wireplumber.nix b/nixos/modules/services/desktops/pipewire/wireplumber.nix
index cccb892cecf7af..9b07c0eb2ad835 100644
--- a/nixos/modules/services/desktops/pipewire/wireplumber.nix
+++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix
@@ -61,7 +61,8 @@ in
         # in sections.
         type = attrsOf (attrsOf json.type);
         default = { };
-        example = literalExpression ''{
+        example = literalExpression ''
+        {
           "log-level-debug" = {
             "context.properties" = {
               # Output Debug log messages as opposed to only the default level (Notice)
@@ -88,7 +89,8 @@ in
               }
             ];
           };
-        }'';
+        }
+        '';
         description = ''
           Additional configuration for the WirePlumber daemon when run in
           single-instance mode (the default in nixpkgs and currently the only
@@ -166,7 +168,8 @@ in
       configPackages = mkOption {
         type = listOf package;
         default = [ ];
-        example = literalExpression ''[
+        example = literalExpression ''
+        [
           (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/10-bluez.conf" '''
             monitor.bluez.properties = {
               bluez5.roles = [ a2dp_sink a2dp_source bap_sink bap_source hsp_hs hsp_ag hfp_hf hfp_ag ]
@@ -175,7 +178,8 @@ in
               bluez5.hfphsp-backend = "native"
             }
           ''')
-        ]'';
+        ]
+        '';
         description = ''
           List of packages that provide WirePlumber configuration, in the form of
           `share/wireplumber/*/*.conf` files.
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 80bbee5f49ce94..6acc2a6f6987ac 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1080,12 +1080,13 @@ in {
     warnings = [
       (mkIf
         (cfg.registry.enable && versionAtLeast (getVersion cfg.packages.gitlab) "16.0.0" && cfg.registry.package == pkgs.docker-distribution)
-        ''Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.
+        ''
+          Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.
           Please back up your data and migrate to the gitlab-container-registry package.''
       )
       (mkIf
-        (versionAtLeast (getVersion cfg.packages.gitlab) "16.2.0" && versionOlder (getVersion cfg.packages.gitlab) "16.5.0")
-        ''GitLab instances created or updated between versions [15.11.0, 15.11.2] have an incorrect database schema.
+        (versionAtLeast (getVersion cfg.packages.gitlab) "16.2.0" && versionOlder (getVersion cfg.packages.gitlab) "16.5.0") ''
+        GitLab instances created or updated between versions [15.11.0, 15.11.2] have an incorrect database schema.
         Check the upstream documentation for a workaround: https://docs.gitlab.com/ee/update/versions/gitlab_16_changes.html#undefined-column-error-upgrading-to-162-or-later''
       )
     ];
diff --git a/nixos/modules/services/network-filesystems/ceph.nix b/nixos/modules/services/network-filesystems/ceph.nix
index 5961731dbf446a..d71019086f49f1 100644
--- a/nixos/modules/services/network-filesystems/ceph.nix
+++ b/nixos/modules/services/network-filesystems/ceph.nix
@@ -42,8 +42,9 @@ let
       StateDirectory = stateDirectory;
       User = "ceph";
       Group = if daemonType == "osd" then "disk" else "ceph";
-      ExecStart = ''${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \
-                    -f --cluster ${clusterName} --id ${daemonId}'';
+      ExecStart = ''
+        ${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \
+        -f --cluster ${clusterName} --id ${daemonId}'';
     } // lib.optionalAttrs (daemonType == "osd") {
       ExecStartPre = "${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${daemonId} --cluster ${clusterName}";
       RestartSec = "20s";
diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix
index f96853939bd296..483f579b354a3f 100644
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@@ -119,7 +119,8 @@ in
               MAX  0.5 144   7200
               MIN  0.5 144   7200
         '';
-        description = ''Configure the ping frequency and retention of the rrd files.
+        description = ''
+          Configure the ping frequency and retention of the rrd files.
           Once set, changing the interval will require deletion or migration of all
           the collected data.'';
       };
diff --git a/nixos/modules/services/networking/tinyproxy.nix b/nixos/modules/services/networking/tinyproxy.nix
index 6e07c6a541e9bf..bcf8fbbca726b9 100644
--- a/nixos/modules/services/networking/tinyproxy.nix
+++ b/nixos/modules/services/networking/tinyproxy.nix
@@ -33,14 +33,16 @@ in
       settings = mkOption {
         description = "Configuration for [tinyproxy](https://tinyproxy.github.io/).";
         default = { };
-        example = literalExpression ''{
+        example = literalExpression ''
+        {
           Port 8888;
           Listen 127.0.0.1;
           Timeout 600;
           Allow 127.0.0.1;
           Anonymous = ['"Host"' '"Authorization"'];
           ReversePath = '"/example/" "http://www.example.com/"';
-        }'';
+        }
+        '';
         type = types.submodule ({name, ...}: {
           freeformType = settingsFormat.type;
           options = {
diff --git a/nixos/modules/services/networking/wg-quick.nix b/nixos/modules/services/networking/wg-quick.nix
index 369c5a93976590..2130c49f374ec9 100644
--- a/nixos/modules/services/networking/wg-quick.nix
+++ b/nixos/modules/services/networking/wg-quick.nix
@@ -194,7 +194,8 @@ let
       allowedIPs = mkOption {
         example = [ "10.192.122.3/32" "10.192.124.1/24" ];
         type = with types; listOf str;
-        description = ''List of IP (v4 or v6) addresses with CIDR masks from
+        description = ''
+        List of IP (v4 or v6) addresses with CIDR masks from
         which this peer is allowed to send incoming traffic and to which
         outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
         be specified for matching all IPv4 addresses, and ::/0 may be specified
@@ -205,7 +206,8 @@ let
         default = null;
         example = "demo.wireguard.io:12913";
         type = with types; nullOr str;
-        description = ''Endpoint IP or hostname of the peer, followed by a colon,
+        description = ''
+        Endpoint IP or hostname of the peer, followed by a colon,
         and then a port number of the peer.'';
       };
 
@@ -213,7 +215,8 @@ let
         default = null;
         type = with types; nullOr int;
         example = 25;
-        description = ''This is optional and is by default off, because most
+        description = ''
+        This is optional and is by default off, because most
         users will not need it. It represents, in seconds, between 1 and 65535
         inclusive, how often to send an authenticated empty packet to the peer,
         for the purpose of keeping a stateful firewall or NAT mapping valid
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index a3308a1cd39644..5d9bcc9e767a27 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -127,7 +127,8 @@ let
         default = null;
         type = with types; nullOr str;
         example = "container";
-        description = ''The pre-existing network namespace in which the
+        description = ''
+        The pre-existing network namespace in which the
         WireGuard interface is created, and which retains the socket even if the
         interface is moved via {option}`interfaceNamespace`. When
         `null`, the interface is created in the init namespace.
@@ -139,7 +140,8 @@ let
         default = null;
         type = with types; nullOr str;
         example = "init";
-        description = ''The pre-existing network namespace the WireGuard
+        description = ''
+        The pre-existing network namespace the WireGuard
         interface is moved to. The special value `init` means
         the init namespace. When `null`, the interface is not
         moved.
@@ -262,7 +264,8 @@ let
       allowedIPs = mkOption {
         example = [ "10.192.122.3/32" "10.192.124.1/24" ];
         type = with types; listOf str;
-        description = ''List of IP (v4 or v6) addresses with CIDR masks from
+        description = ''
+        List of IP (v4 or v6) addresses with CIDR masks from
         which this peer is allowed to send incoming traffic and to which
         outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
         be specified for matching all IPv4 addresses, and ::/0 may be specified
@@ -328,7 +331,8 @@ let
         default = null;
         type = with types; nullOr int;
         example = 25;
-        description = ''This is optional and is by default off, because most
+        description = ''
+        This is optional and is by default off, because most
         users will not need it. It represents, in seconds, between 1 and 65535
         inclusive, how often to send an authenticated empty packet to the peer,
         for the purpose of keeping a stateful firewall or NAT mapping valid
diff --git a/nixos/modules/services/web-apps/galene.nix b/nixos/modules/services/web-apps/galene.nix
index aec180702abc64..f7b6816108cba7 100644
--- a/nixos/modules/services/web-apps/galene.nix
+++ b/nixos/modules/services/web-apps/galene.nix
@@ -150,7 +150,8 @@ in
           User = cfg.user;
           Group = cfg.group;
           WorkingDirectory = cfg.stateDir;
-          ExecStart = ''${cfg.package}/bin/galene \
+          ExecStart = ''
+          ${cfg.package}/bin/galene \
           ${optionalString (cfg.insecure) "-insecure"} \
           -http ${cfg.httpAddress}:${cfg.httpPort} \
           -turn ${cfg.turnAddress} \
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index eae005bca54530..6b5b10a3387663 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -767,15 +767,17 @@ in {
       description = ''
         Extra options which should be appended to Nextcloud's config.php file.
       '';
-      example = literalExpression '' {
-        redis = {
-          host = "/run/redis/redis.sock";
-          port = 0;
-          dbindex = 0;
-          password = "secret";
-          timeout = 1.5;
-        };
-      } '';
+      example = literalExpression ''
+        {
+          redis = {
+            host = "/run/redis/redis.sock";
+            port = 0;
+            dbindex = 0;
+            password = "secret";
+            timeout = 1.5;
+          };
+        }
+      '';
     };
 
     secretFile = mkOption {
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 47868a6862ff12..1a35d9be2d7247 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -318,8 +318,8 @@ in
 
     system.extraSystemBuilderCmds =
       optionalString
-        config.system.copySystemConfiguration
-        ''ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \
+        config.system.copySystemConfiguration ''
+          ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \
             "$out/configuration.nix"
         '' +
       optionalString