For secrets not part of the nix store there is no other way in NixOS to restart a service after the secret is updated. One example is changing password in userborn, which doesn't run as a activation script but as a systemd service.
--show-trace
nix-unit
83ec5a063a
7314f6b2ff