{ ... }:

{
  # Trust the DEFENK VPN's private root certificate system-wide.
  security.pki.certificateFiles = [ ./root_ca.crt ];
}