Set merge + mkIf always surprises me

nixos/modules/security/pam.nix

@@ -478,10 +478,10 @@ in
         owner = "root";
         setuid = true;
       };
-    } // (mkIf config.security.pam.enableEcryptfs {
+    } // (if config.security.pam.enableEcryptfs then {
       "mount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/mount.ecryptfs_private";
        "umount.ecryptfs_private".source = "${pkgs.ecryptfs.out}/bin/umount.ecryptfs_private";
-    });
+    } else {});
 
     environment.etc =
       mapAttrsToList (n: v: makePAMService v) config.security.pam.services;

nixos/modules/security/wrappers/default.nix

@@ -152,6 +152,9 @@ in
 
   ###### implementation
   config = {
+
+    security.wrappers.fusermount.source = "${pkgs.fuse}/bin/fusermount";
+
     # Make sure our wrapperDir exports to the PATH env variable when
     # initializing the shell
     environment.extraInit = ''