{ ... }: {
  boot.initrd.availableKernelModules = [ "hv_vmbus" "hv_storvsc" ];

  # since tailscale tries to use the TPM and we're sharing the same install
  # between Hyper-V and bare metal, we have to turn encryption off for tailscaled to work:
  systemd.services.tailscaled.environment = {
    TS_ENCRYPT_STATE = "false";
  };

  virtualisation.hypervGuest.enable = true;
}