Moving the service before multi-user.target (so the `hardened` test continue to work the way it did before) can result in locking the kernel too early. It's better to lock it a bit later and changing the test to wait specifically for the disable-kernel-module-loading.service.
*** NixOS *** NixOS is a Linux distribution based on the purely functional package management system Nix. More information can be found at https://nixos.org/nixos and in the manual in doc/manual.