Maybe you hit nixos/displayManager: add XDG_SESSION_ID to systemd user environment by evenbrenden · Pull Request #93764 · NixOS/nixpkgs · GitHub. Currently, calling loginctl lock-session will not trigger xss-lock when run as a user service because it doesn’t know what session to use. Could be the case for idle hints as well. You could try passing --session [session ID] to programs.xss-lock.extraOptions using your current session ID just to check if this is it. Make sure you run systemctl --user restart xss-lock.service after rebuilding.