diff --git a/hosts/servo/services/nginx.nix b/hosts/servo/services/nginx.nix
index 077104ba..aa319379 100644
--- a/hosts/servo/services/nginx.nix
+++ b/hosts/servo/services/nginx.nix
@@ -3,7 +3,7 @@
 
 let
   # make the logs for this host "public" so that they show up in e.g. metrics
-  publog = vhost: vhost // {
+  publog = vhost: lib.attrsets.unionOfDisjoint vhost {
     extraConfig = (vhost.extraConfig or "") + ''
       access_log /var/log/nginx/public.log vcombined;
     '';
diff --git a/modules/home-manager/default.nix b/modules/home-manager/default.nix
index de82c174..67d74f19 100644
--- a/modules/home-manager/default.nix
+++ b/modules/home-manager/default.nix
@@ -131,11 +131,14 @@ in
       # <item oor:path="/org.openoffice.Setup/Product"><prop oor:name="LastTimeGetInvolvedShown" oor:op="fuse"><value>1667693880</value></prop></item>
 
 
-      programs = {
-        home-manager.enable = true;  # this lets home-manager manage dot-files in user dirs, i think
-        # "command not found" will cause the command to be searched in nixpkgs
-        nix-index.enable = true;
-      } // cfg.programs;
+      programs = lib.mkMerge [
+        {
+          home-manager.enable = true;  # this lets home-manager manage dot-files in user dirs, i think
+          # "command not found" will cause the command to be searched in nixpkgs
+          nix-index.enable = true;
+        }
+        cfg.programs
+      ];
     };
   };
 }
diff --git a/modules/home-manager/gfeeds.nix b/modules/home-manager/gfeeds.nix
index 707890d9..0d6e744d 100644
--- a/modules/home-manager/gfeeds.nix
+++ b/modules/home-manager/gfeeds.nix
@@ -10,9 +10,10 @@ in {
     builtins.toJSON {
       # feed format is a map from URL to a dict,
       #   with dict["tags"] a list of string tags.
-      feeds = builtins.foldl' (acc: feed: acc // {
-        "${feed.url}".tags = [ feed.cat feed.freq ];
-      }) {} wanted-feeds;
+      feeds = sane-lib.mapToAttrs (feed: {
+        name = feed.url;
+        value.tags = [ feed.cat feed.freq ];
+      }) wanted-feeds;
       dark_reader = false;
       new_first = true;
       # windowsize = {
diff --git a/modules/lib/default.nix b/modules/lib/default.nix
index d2998fa4..0ea34ada 100644
--- a/modules/lib/default.nix
+++ b/modules/lib/default.nix
@@ -16,12 +16,18 @@ rec {
   # Type: filterNonNull :: AttrSet -> AttrSet
   filterNonNull = attrs: lib.filterAttrsRecursive (n: v: v != null) attrs;
 
+  # return only the subset of `attrs` whose name is in the provided set.
+  # Type: filterByName :: [String] -> AttrSet
+  filterByName = names: attrs: lib.filterAttrs
+    (name: value: builtins.elem name names)
+    attrs;
+
   # transform a list into an AttrSet via a function which maps an element to a name + value
-  # Type: mapToAttrs :: (a -> { name, value }) -> [a] -> AttrSet
+  # Type: mapToAttrs :: (a -> { name :: String, value :: Any }) -> [a] -> AttrSet
   mapToAttrs = f: list: builtins.listToAttrs (builtins.map f list);
 
-  # flatten a nested AttrSet into a list of { path = [str]; value } items.
-  # Type: flattenAttrs :: AttrSet[item|AttrSet] -> [{ path; value; }]
+  # flatten a nested AttrSet into a list of { path = [String]; value } items.
+  # Type: flattenAttrs :: AttrSet[AttrSet|Any] -> [{ path :: String, value :: Any }]
   flattenAttrs = flattenAttrs' [];
   flattenAttrs' = path: value: if builtins.isAttrs value then (
     builtins.concatLists (
diff --git a/modules/lib/fs.nix b/modules/lib/fs.nix
index 489eff2b..c43f5fec 100644
--- a/modules/lib/fs.nix
+++ b/modules/lib/fs.nix
@@ -1,7 +1,7 @@
 { lib, ... }:
 
 rec {
-  wanted = lib.mergeAttrs { wantedBeforeBy = [ "multi-user.target" ]; };
+  wanted = lib.attrsets.unionOfDisjoint { wantedBeforeBy = [ "multi-user.target" ]; };
   wantedSymlink = symlink: wanted { inherit symlink; };
   wantedSymlinkTo = target: wantedSymlink { inherit target; };
   wantedText = text: wantedSymlink { inherit text; };
diff --git a/modules/persist/default.nix b/modules/persist/default.nix
index dfed3be5..28578728 100644
--- a/modules/persist/default.nix
+++ b/modules/persist/default.nix
@@ -100,13 +100,12 @@ let
   # toplevel and move them into an `acl` attribute.
   convertInlineAcl = to: types.coercedTo
     types.attrs
-    (orig: (builtins.removeAttrs orig ["user" "group" "mode" ]) // {
-      acl = (orig.acl or {}) // (sane-lib.filterNonNull {
-        user = orig.user or null;
-        group = orig.group or null;
-        mode = orig.mode or null;
-      });
-    })
+    (orig: lib.recursiveUpdate
+      (builtins.removeAttrs orig ["user" "group" "mode" ])
+      {
+        acl = sane-lib.filterByName ["user" "group" "mode"] (orig.acl or {});
+      }
+    )
     to;
 
   # entry where the path is specified externally
@@ -125,24 +124,26 @@ let
   #   <option>.private.".cache/vim" = { mode = "0700"; };
   # to place ".cache/vim" into the private store and create with the appropriate mode
   dirsSubModule = types.submodule ({ config, ... }: {
-    options = (mapAttrs (store: store-cfg: mkOption {
-      default = [];
-      type = types.listOf (convertInlineAcl entryInStoreOrShorthand);
-      description = let
-        suffix = if store-cfg.storeDescription != null then
-          ": ${store-cfg.storeDescription}"
-        else "";
-      in "directories to persist in ${store}${suffix}";
-    }) cfg.stores) // {
-      byPath = mkOption {
-        type = types.attrsOf (convertInlineAcl entryAtPath);
-        default = {};
-        description = ''
-          map of <path> => <path config> for all paths to be persisted.
-          this is computed from the other options, but users can also set it explicitly (useful for overriding)
-        '';
+    options = lib.attrsets.unionOfDisjoint
+      (mapAttrs (store: store-cfg: mkOption {
+        default = [];
+        type = types.listOf (convertInlineAcl entryInStoreOrShorthand);
+        description = let
+          suffix = if store-cfg.storeDescription != null then
+            ": ${store-cfg.storeDescription}"
+          else "";
+        in "directories to persist in ${store}${suffix}";
+      }) cfg.stores)
+      {
+        byPath = mkOption {
+          type = types.attrsOf (convertInlineAcl entryAtPath);
+          default = {};
+          description = ''
+            map of <path> => <path config> for all paths to be persisted.
+            this is computed from the other options, but users can also set it explicitly (useful for overriding)
+          '';
+        };
       };
-    };
     config = let
       # set the `store` attribute on one dir attrset
       annotateWithStore = store: dir: {