systemd.sysusers.enable = true;
  system.etc.overlay.enable = true;
  system.etc.overlay.mutable = true;

doas nixos-rebuild switch (or with colmena apply-local --sudo)
<..snip
ktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager ListUnitsByNames as 1 -- dbus-broker.service' exited with value 1 at /nix/store/0wsk0nwb6bq5f8bfxwny6bww68c44pji-nixos-system-kaambl-24.05.20240408.4cba8b5/bin/switch-to-configuration line 145.
kaambl | Activation failed: Child process exited with error code: 1
       | Failed: Child process exited with error code: 1
[ERROR] Failed to complete requested operation - Last 1 lines of logs:
[ERROR]  failure) Child process exited with error code: 1
[ERROR] Failed to deploy to kaambl - Last 20 lines of logs:
[ERROR]   stderr) Successfully installed Lanzaboote.
[ERROR]   stderr) stopping the following units: agenix-install-secrets.service, dae.service, systemd-tmpfiles-resetup.service, systemd-udevd-control.socket, systemd-udevd-kernel.socket, systemd-udevd.service
[ERROR]   stderr) activating the configuration...
[ERROR]   stdout) remounting /etc...
[ERROR]   stderr) mount: /tmp/tmp.T2fXevh7N0: overlay already mounted on /etc.
[ERROR]   stderr)        dmesg(1) may have more information after failed mount system call.
[ERROR]   stderr) Moving mount
[ERROR]   stderr) Mounting beneath top mount
[ERROR]   stderr) Invalid argument | move-mount.c: 553: main: move_mount
[ERROR]   stdout) Attaching mount /tmp/tmp.T2fXevh7N0 -> /etc
[ERROR]   stdout) Moving single attached mount
[ERROR]   stdout) Activation script snippet 'etc' failed (1)
[ERROR]   stderr) Reload daemon failed: Connection reset by peer
[ERROR]   stderr) reloading user units for elen...
[ERROR]   stderr) su: Cannot determine your user name.
[ERROR]   stderr) restarting sysinit-reactivation.target
[ERROR]   stderr) Failed to restart sysinit-reactivation.target: Connection timed out
[ERROR]   stderr) See system logs and 'systemctl status sysinit-reactivation.target' for details.
[ERROR]   stderr) '/nix/store/ydkp4xlbpmvf1j5xp09rw70vy3vb5n5a-system-path/bin/busctl --json=short call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager ListUnitsByNames as 1 -- dbus-broker.service' exited with value 1 at /nix/store/0wsk0nwb6bq5f8bfxwny6bww68c44pji-nixos-system-kaambl-24.05.20240408.4cba8b5/bin/switch-to-configuration line 145.
[ERROR]  failure) Child process exited with error code: 1
[ERROR] -----
[ERROR] Operation failed with error: Child process exited with error code: 1
Hint: Backtrace available - Use `RUST_BACKTRACE=1` environment variable to display a backtrace

Apr 11 02:01:29 kaambl kernel: erofs: (device loop1): mounted with root inode @ nid 36.
Apr 11 02:01:29 kaambl kernel: overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.