Make ACME renew systemd-service depend on DNS/nss-lookup?

I wonder if the ACME renew service should depend on or not.
I have unbound as local DNS, when doing nixos-rebuild, the ACME renew services cannot resolve letsencrypt hosts because the local DNS (unbound) is not yet started.

Unbound systemd sets it should start before nss-lookup.

The most logical thing should be that the ACME renew services should execute after

I can fix this in my own configuration with some hacks, but I wonder if this shouldn;t be the default in NixOS?

Chances are high you are one of very few users of this setup, and it‘s awesome that you put your idea into the open instead of being satisfied with your hack. Why not submit a PR and include your reasoning? Seems like ideally it is just one line of code. I‘ll be happy to review if you reference the PR in this thread. That would be yet another little thing that Just Works™, and your contribution will make NixOS and the world a better place.

I think adding here (in after and/or wants?) should work: