# Breaking changes announcement for unstable

**URL:** https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574
**Category:** Development
**Created:** [February 8, 2022, 11:18am UTC](https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574 "2022-02-08T11:18:51Z")
**Posts on this page:** 1
**Showing post:** 116

<div class="post-metadata">

### Author: ![rnhmjoj](https://discourse.nixos.org/user_avatar/discourse.nixos.org/rnhmjoj/32/1792_2.png) [@rnhmjoj](https://discourse.nixos.org/u/rnhmjoj)
#### Post date: [December 27, 2025, 9:48am UTC](https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/116 "2025-12-27T09:48:23Z")

</div>

The `networking.wireless` module has been security hardened: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.

Some backward incompatibilities:

- `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using `networking.wireless.allowAuxiliaryImperativeNetworks`.

- If client certificates, keys or other files are needed, these should be stored under `/etc/wpa_supplicant` and owned by `wpa_supplicant` to ensure the daemon can read them.

- the `networking.wireless.userControlled.group` option has been removed since there is now a dedicated `wpa_supplicant` group to control the daemon, and `networking.wireless.userControlled.enable` has been renamed to `networking.wireless.userControlled`.

No functionality should have been impacted by these changes (including controlling via `wpa_cli`, integration with NetworkManager or connman), but if you find any problems, please open an issue on GitHub.

**Note for NetworkManager users** : before this changes NetworkManager spawned its own `wpa_supplicant` daemon, but now it uses `networking.wireless`. So, if you have a `networking.wireless.enable = false` in your configuration, you should remove that line.

link to PR: [nixos/wpa\_supplicant: harden and run as unprivileged user by rnhmjoj · Pull Request #427528 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/pull/427528#issuecomment-3409453330)

---

_[View the full topic](https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574)._