{
  lib,
  pkgs,
  ...
}:

let
  # bool -> nixpkgs[]
  wrappedNixExecutables = inEnvironment: assert builtins.isBool inEnvironment; pkgs.symlinkJoin {
    name = "${pkgs.nix.name}-wrap";
    paths = [ pkgs.nix ];
    nativeBuildInputs = [
      pkgs.makeWrapper
    ];
    postBuild = ''
      wrapProgram $out/bin/nix-build \
        --add-flags "--log-format" \
        --add-flags "bar${lib.optionalString inEnvironment "-with-logs"}"
      wrapProgram $out/bin/nix-shell \
        --add-flags "--log-format" \
        --add-flags "bar"
      wrapProgram $out/bin/nix-env \
        --add-flags "--log-format" \
        --add-flags "bar"
    '';
    passthru = {
      inherit (pkgs.nix) man meta version;
    };
  };

  # nixpkgs PR389487
  # https://github.com/NixOS/nixpkgs/pull/389487
  futureNixosExecutables = let
    nixpkgs = builtins.fetchTarball {
      url = "https://github.com/NixOS/nixpkgs/archive/e8f4dba5135ce202c7ef77118f145ef8b3803088.tar.gz";
      sha256 = "1ssqca6x9g6ys754zj2sdvsi85hwfhqd04pa445gavr4wiadgv0b";
    };
  in pkgs.callPackage "${nixpkgs}/pkgs/os-specific/linux/nixos-rebuild/default.nix" {};

  wrappedNixosExecutables = pkgs.symlinkJoin {
    name = "${pkgs.nixos-rebuild.name}-wrap";
    paths = [ futureNixosExecutables ];
    nativeBuildInputs = [
      pkgs.makeWrapper
    ];
    postBuild = ''
      wrapProgram $out/bin/nixos-rebuild \
        --add-flags "--log-format" \
        --add-flags "bar" \
        --add-flags "--use-remote-sudo"
    '';
  };
in {
  config = {
    nix.package = wrappedNixExecutables false;
    environment.systemPackages = lib.map (lib.hiPrio) [
      (wrappedNixExecutables true)
      wrappedNixosExecutables
    ];
    system.build.nixos-rebuild = lib.mkForce wrappedNixosExecutables;
    system.tools.nixos-rebuild.enable = false;
  };
}