http://hydra.nixos.org/build/6494972 Disabling slim revealed that services.xserver.displayManager.job had an incorrect type, so fixed that as well.
That is, you can say security.pam.services.sshd = { options... }; instead of security.pam.services = [ { name = "sshd"; options... } ]; making it easier to override PAM settings from other modules.