Does NixOS have a good security update story yet? Last time I looked, security updates in widely-used libraries like glibc could get bogged down in huge rebuilds because of the way dependencies are specified/resolved. There was some kind of hack to bypass this, but I think it required manual config changes for each update. The wiki seems to have evaporated, so I'm not sure what's current.