diff --git a/modules/services/podman-linux/default.nix b/modules/services/podman-linux/default.nix
index 0eae79ce7..3fffaca4d 100644
--- a/modules/services/podman-linux/default.nix
+++ b/modules/services/podman-linux/default.nix
@@ -11,61 +11,63 @@ in {
   options.services.podman = {
     enable = lib.mkEnableOption "Podman, a daemonless container engine";
 
-    containersConf.settings = lib.mkOption {
-      type = toml.type;
-      default = { };
-      description = "containers.conf configuration";
-    };
-
-    storage.settings = lib.mkOption {
-      type = toml.type;
-      description = "storage.conf configuration";
-    };
-
-    registries = {
-      search = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "docker.io" ];
-        description = ''
-          List of repositories to search.
-        '';
+    config = {
+      containers.settings = lib.mkOption {
+        type = toml.type;
+        default = { };
+        description = "containers.conf configuration";
       };
 
-      insecure = lib.mkOption {
-        default = [ ];
-        type = lib.types.listOf lib.types.str;
-        description = ''
-          List of insecure repositories.
-        '';
+      storage.settings = lib.mkOption {
+        type = toml.type;
+        description = "storage.conf configuration";
       };
 
-      block = lib.mkOption {
-        default = [ ];
-        type = lib.types.listOf lib.types.str;
-        description = ''
-          List of blocked repositories.
-        '';
-      };
-    };
+      registries = {
+        search = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "docker.io" ];
+          description = ''
+            List of repositories to search.
+          '';
+        };
 
-    policy = lib.mkOption {
-      default = { };
-      type = lib.types.attrs;
-      example = lib.literalExpression ''
-        {
-          default = [ { type = "insecureAcceptAnything"; } ];
-          transports = {
-            docker-daemon = {
-              "" = [ { type = "insecureAcceptAnything"; } ];
+        insecure = lib.mkOption {
+          default = [ ];
+          type = lib.types.listOf lib.types.str;
+          description = ''
+            List of insecure repositories.
+          '';
+        };
+
+        block = lib.mkOption {
+          default = [ ];
+          type = lib.types.listOf lib.types.str;
+          description = ''
+            List of blocked repositories.
+          '';
+        };
+      };
+
+      policy = lib.mkOption {
+        default = { };
+        type = lib.types.attrs;
+        example = lib.literalExpression ''
+          {
+            default = [ { type = "insecureAcceptAnything"; } ];
+            transports = {
+              docker-daemon = {
+                "" = [ { type = "insecureAcceptAnything"; } ];
+              };
             };
-          };
-        }
-      '';
-      description = ''
-        Signature verification policy file.
-        If this option is empty the default policy file from
-        `skopeo` will be used.
-      '';
+          }
+        '';
+        description = ''
+          Signature verification policy file.
+          If this option is empty the default policy file from
+          `skopeo` will be used.
+        '';
+      };
     };
   };
 
@@ -75,22 +77,23 @@ in {
 
     home.packages = [ cfg.package ];
 
-    services.podman.storage.settings = {
+    services.podman.config.storage.settings = {
       storage.driver = lib.mkDefault "overlay";
     };
 
     xdg.configFile = {
-      "containers/policy.json".source = if cfg.policy != { } then
-        pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
+      "containers/policy.json".source = if cfg.config.policy != { } then
+        pkgs.writeText "policy.json" (builtins.toJSON cfg.config.policy)
       else
         "${pkgs.skopeo.policy}/default-policy.json";
       "containers/registries.conf".source = toml.generate "registries.conf" {
-        registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
+        registries =
+          lib.mapAttrs (n: v: { registries = v; }) cfg.config.registries;
       };
       "containers/storage.conf".source =
-        toml.generate "storage.conf" cfg.storage.settings;
+        toml.generate "storage.conf" cfg.config.storage.settings;
       "containers/containers.conf".source =
-        toml.generate "containers.conf" cfg.containersConf.settings;
+        toml.generate "containers.conf" cfg.config.containers.settings;
     };
   };
 }
diff --git a/tests/modules/services/podman-linux/configuration.nix b/tests/modules/services/podman-linux/configuration.nix
index e6e1e4f16..c86d18ad1 100644
--- a/tests/modules/services/podman-linux/configuration.nix
+++ b/tests/modules/services/podman-linux/configuration.nix
@@ -3,33 +3,35 @@
 {
   services.podman = {
     enable = true;
-    containersConf.settings = {
-      network = {
-        default_subnet = "172.16.10.0/24";
-        default_subnet_pools = [
-          {
-            base = "172.16.11.0/24";
-            size = 24;
-          }
-          {
-            base = "172.16.12.0/24";
-            size = 24;
-          }
-        ];
+    config = {
+      containers.settings = {
+        network = {
+          default_subnet = "172.16.10.0/24";
+          default_subnet_pools = [
+            {
+              base = "172.16.11.0/24";
+              size = 24;
+            }
+            {
+              base = "172.16.12.0/24";
+              size = 24;
+            }
+          ];
+        };
       };
-    };
-    storage.settings = {
-      storage = {
-        runroot = "$HOME/.containers/runroot";
-        graphroot = "$HOME/.containers/graphroot";
+      storage.settings = {
+        storage = {
+          runroot = "$HOME/.containers/runroot";
+          graphroot = "$HOME/.containers/graphroot";
+        };
       };
+      registries = {
+        block = [ "ghcr.io" "gallery.ecr.aws" ];
+        insecure = [ "quay.io" ];
+        search = [ "docker.io" ];
+      };
+      policy = { default = [{ type = "insecureAcceptAnything"; }]; };
     };
-    registries = {
-      block = [ "ghcr.io" "gallery.ecr.aws" ];
-      insecure = [ "quay.io" ];
-      search = [ "docker.io" ];
-    };
-    policy = { default = [{ type = "insecureAcceptAnything"; }]; };
   };
 
   nmt.script = ''