security.nix: pass NIX_PATH
nixpkgs bump