diff --git a/modules/config/networking.nix b/modules/config/networking.nix
index 9e55549ea2e7..4cd74f791980 100644
--- a/modules/config/networking.nix
+++ b/modules/config/networking.nix
@@ -38,35 +38,27 @@ in
   require = [options];
 
   environment.etc =
-    [ { # /etc/services: TCP/UDP port assignments.
-        source = pkgs.iana_etc + "/etc/services";
-        target = "services";
-      }
+    { # /etc/services: TCP/UDP port assignments.
+      "services".source = pkgs.iana_etc + "/etc/services";
 
-      { # /etc/protocols: IP protocol numbers.
-        source = pkgs.iana_etc + "/etc/protocols";
-        target = "protocols";
-      }
+      # /etc/protocols: IP protocol numbers.
+      "protocols".source  = pkgs.iana_etc + "/etc/protocols";
 
-      { # /etc/rpc: RPC program numbers.
-        source = pkgs.glibc + "/etc/rpc";
-        target = "rpc";
-      }
+      # /etc/rpc: RPC program numbers.
+      "rpc".source = pkgs.glibc + "/etc/rpc";
 
-      { # /etc/hosts: Hostname-to-IP mappings.
-        source = pkgs.writeText "hosts"
-          ''
-            127.0.0.1 localhost
-            ${optionalString cfg.enableIPv6 ''
-              ::1 localhost
-            ''}
-            ${cfg.extraHosts}
-          '';
-        target = "hosts";
-      }
+      # /etc/hosts: Hostname-to-IP mappings.
+      "hosts".source = pkgs.writeText "hosts"
+        ''
+          127.0.0.1 localhost
+          ${optionalString cfg.enableIPv6 ''
+            ::1 localhost
+          ''}
+          ${cfg.extraHosts}
+        '';
 
-      { # /etc/resolvconf.conf: Configuration for openresolv.
-        source = pkgs.writeText "resolvconf.conf" (
+      # /etc/resolvconf.conf: Configuration for openresolv.
+      "resolvconf.conf".source = pkgs.writeText "resolvconf.conf" (
           ''
             # This is the default, but we must set it here to prevent
             # a collision with an apparently unrelated environment
@@ -83,9 +75,7 @@ in
             # This hosts runs a full-blown DNS resolver.
             name_servers='127.0.0.1'
           '' );
-        target = "resolvconf.conf";
-      }
-    ];
+    };
 
   # The ‘ip-up’ target is started when we have IP connectivity.  So
   # services that depend on IP connectivity (like ntpd) should be
diff --git a/modules/system/etc/etc.nix b/modules/system/etc/etc.nix
index 1300562b99cb..6fa50400a7fc 100644
--- a/modules/system/etc/etc.nix
+++ b/modules/system/etc/etc.nix
@@ -6,6 +6,8 @@ with pkgs.lib;
 
 let
 
+  etc' = attrValues config.environment.etc;
+
   etc = pkgs.stdenv.mkDerivation {
     name = "etc";
 
@@ -14,9 +16,9 @@ let
     preferLocalBuild = true;
 
     /* !!! Use toXML. */
-    sources = map (x: x.source) config.environment.etc;
-    targets = map (x: x.target) config.environment.etc;
-    modes = map (x: x.mode) config.environment.etc;
+    sources = map (x: x.source) etc';
+    targets = map (x: x.target) etc';
+    modes = map (x: x.mode) etc';
   };
 
 in
@@ -28,34 +30,51 @@ in
   options = {
 
     environment.etc = mkOption {
-      default = [];
-      example = [
-        { source = "/nix/store/.../etc/dir/file.conf.example";
-          target = "dir/file.conf";
-          mode = "0440";
-        }
-      ];
+      type = types.loaOf types.optionSet;
+      default = {};
+      example =
+        { hosts =
+            { source = "/nix/store/.../etc/dir/file.conf.example";
+              mode = "0440";
+            };
+          "default/useradd".text = "GROUP=100 ...";
+        };
       description = ''
-        List of files that have to be linked in <filename>/etc</filename>.
+        Set of files that have to be linked in <filename>/etc</filename>.
       '';
-      type = types.listOf types.optionSet;
-      options = {
-        source = mkOption {
-          description = "Source file.";
-        };
-        target = mkOption {
-          description = "Name of symlink (relative to <filename>/etc</filename>).";
-        };
-        mode = mkOption {
-          default = "symlink";
-          example = "0600";
-          description = ''
-            If set to something else than <literal>symlink</literal>,
-            the file is copied instead of symlinked, with the given
-            file mode.
-          '';
-        };
-      };
+
+      options = singleton ({ name, config, ... }:
+        { options = {
+            source = mkOption {
+              description = "Path of the source file.";
+            };
+
+            target = mkOption {
+              description = ''
+                Name of symlink (relative to
+                <filename>/etc</filename>).  Defaults to the attribute
+                name.
+              '';
+            };
+
+            mode = mkOption {
+              default = "symlink";
+              example = "0600";
+              description = ''
+                If set to something else than <literal>symlink</literal>,
+                the file is copied instead of symlinked, with the given
+                file mode.
+              '';
+            };
+
+          };
+
+          config = {
+            target = mkDefault name;
+          };
+
+        });
+
     };
 
   };
diff --git a/modules/tasks/kbd.nix b/modules/tasks/kbd.nix
index e4d22e94c80c..145e43794e59 100644
--- a/modules/tasks/kbd.nix
+++ b/modules/tasks/kbd.nix
@@ -65,10 +65,7 @@ in
     # Let systemd-vconsole-setup.service do the work of setting up the
     # virtual consoles.  FIXME: trigger a restart of
     # systemd-vconsole-setup.service if /etc/vconsole.conf changes.
-    environment.etc = singleton
-      { target = "vconsole.conf";
-        source = vconsoleConf;
-      };
+    environment.etc."vconsole.conf".source = vconsoleConf;
 
     # This is identical to the systemd-vconsole-setup.service unit
     # shipped with systemd, except that it uses /dev/tty1 instead of