diff --git a/nixos/modules/security/lock-kernel-modules.nix b/nixos/modules/security/lock-kernel-modules.nix
index 3a1ad4d8b374..fac7ab87cb98 100644
--- a/nixos/modules/security/lock-kernel-modules.nix
+++ b/nixos/modules/security/lock-kernel-modules.nix
@@ -1,15 +1,12 @@
 { config, lib, ... }:
-
-with lib;
-
 {
   meta = {
-    maintainers = [ maintainers.joachifm ];
+    maintainers = [ lib.maintainers.joachifm ];
   };
 
   options = {
-    security.lockKernelModules = mkOption {
-      type = types.bool;
+    security.lockKernelModules = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Disable kernel module loading once the system is fully initialised.
@@ -20,9 +17,9 @@ with lib;
     };
   };
 
-  config = mkIf config.security.lockKernelModules {
-    boot.kernelModules = concatMap (x:
-      optionals (x.device != null) (
+  config = lib.mkIf config.security.lockKernelModules {
+    boot.kernelModules = lib.concatMap (x:
+      lib.optionals (x.device != null) (
         if x.fsType == "vfat"
         then [ "vfat" "nls-cp437" "nls-iso8859-1" ]
         else [ x.fsType ])