diff --git a/nix/pkgs/copybara.nix b/nix/pkgs/copybara.nix
index 85e678483d..7e7c466a83 100644
--- a/nix/pkgs/copybara.nix
+++ b/nix/pkgs/copybara.nix
@@ -17,7 +17,7 @@ pkgs.buildBazelPackage rec {
   ];
 
   fetchAttrs = {
-    sha256 = "1mcb2l0zv52smkj076d3s3jnv80qn8nasv99vshgpbpgqqs39hk3";
+    sha256 = "1nlkkhk7w8lnh3s416w1g1jc4qsirrgb0fggqhqamlpjr1xiv1v5";
     preHook = ''
       export COURSIER_CACHE="$(echo ''${NIX_BUILD_TOP}/tmp/coursier | sed -e 's,//,/,g')"
     '';
diff --git a/ops/nixos/lib/zfs.nix b/ops/nixos/lib/zfs.nix
index a734233f5b..aa1dc01c9a 100644
--- a/ops/nixos/lib/zfs.nix
+++ b/ops/nixos/lib/zfs.nix
@@ -13,6 +13,10 @@ in
       type = types.str;
       default = "zpool/local/root@blank";
     };
+    keepPaths = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+    };
   };
 
   config = {
@@ -23,6 +27,7 @@ in
       enable = true;
       monthly = 1;
     };
+    systemd.tmpfiles.rules = lib.mkAfter (builtins.map (x: "L ${x} - - - - /persist{x}") robCfg.keepPaths);
 
     boot.initrd.postDeviceCommands = mkIf robCfg.enable
       (mkAfter ''