diff --git a/deployment/data-model-test.nix b/deployment/data-model-test.nix
index cfce5db0..24d5cd6c 100644
--- a/deployment/data-model-test.nix
+++ b/deployment/data-model-test.nix
@@ -68,24 +68,26 @@ in
                         default = false;
                       };
                     };
-                    config.resource-type = types.raw; # TODO: splice out the user type from NixOS
-                    config.apply =
-                      requests:
-                      let
-                        # Filter out requests that need wheel if policy doesn't allow it
-                        validRequests = lib.filterAttrs (
-                          _name: req: !req.login-shell.wheel || config.wheel
-                        ) requests.resources;
-                      in
-                      lib.optionalAttrs (validRequests != { }) {
-                        ${config.username} = {
-                          isNormalUser = true;
-                          packages =
-                            with lib;
-                            attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
-                          extraGroups = lib.optional config.wheel "wheel";
+                    config = {
+                      resource-type = types.raw; # TODO: splice out the user type from NixOS
+                      apply =
+                        requests:
+                        let
+                          # Filter out requests that need wheel if policy doesn't allow it
+                          validRequests = lib.filterAttrs (
+                            _name: req: !req.login-shell.wheel || config.wheel
+                          ) requests.resources;
+                        in
+                        lib.optionalAttrs (validRequests != { }) {
+                          ${config.username} = {
+                            isNormalUser = true;
+                            packages =
+                              with lib;
+                              attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
+                            extraGroups = lib.optional config.wheel "wheel";
+                          };
                         };
-                      };
+                    };
                   };
               };
               applications.hello =