diff --git a/patches/257932.patch b/patches/257932.patch
new file mode 100644
index 00000000..d855a2de
--- /dev/null
+++ b/patches/257932.patch
@@ -0,0 +1,29 @@
+diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
+index 7ea9d6a5c71356..e618cf2f861a33 100644
+--- a/nixos/lib/utils.nix
++++ b/nixos/lib/utils.nix
+@@ -177,6 +177,7 @@ rec {
+   genJqSecretsReplacementSnippet' = attr: set: output:
+     let
+       secrets = recursiveGetAttrWithJqPrefix set attr;
++      stringOrDefault = str: def: if str == "" then def else str;
+     in ''
+       if [[ -h '${output}' ]]; then
+         rm '${output}'
+@@ -195,10 +196,12 @@ rec {
+                (attrNames secrets))
+     + "\n"
+     + "${pkgs.jq}/bin/jq >'${output}' "
+-    + lib.escapeShellArg (concatStringsSep
+-      " | "
+-      (imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
+-             (attrNames secrets)))
++    + lib.escapeShellArg (stringOrDefault
++          (concatStringsSep
++            " | "
++            (imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
++                   (attrNames secrets)))
++          ".")
+     + ''
+        <<'EOF'
+       ${builtins.toJSON set}