diff --git a/lib/meta.nix b/lib/meta.nix
index 798e7e74918cc..76a4fee20bb17 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -475,7 +475,7 @@ rec {
       "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
     assert assertMsg (isString y)
       "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
-    assert assertMsg (match ".*\/.*" y == null)
+    assert assertMsg (match ".*\\/.*" y == null)
       "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
     "${getBin x}/bin/${y}";
 }
diff --git a/lib/options.nix b/lib/options.nix
index 5b22b1b37b86d..4bf70af0705d7 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -426,7 +426,7 @@ rec {
     # If the part is a named placeholder of the form "<...>" don't escape it.
     # It may cause misleading escaping if somebody uses literally "<...>" in their option names.
     # This is the trade-off to allow for placeholders in option names.
-    isNamedPlaceholder = builtins.match "\<(.*)\>";
+    isNamedPlaceholder = builtins.match "\\<(.*)\\>";
     escapeOptionPart = part:
       if part == "*" || isNamedPlaceholder part != null
         then part
diff --git a/lib/tests/modules/strMatching-merge.nix b/lib/tests/modules/strMatching-merge.nix
index 2e043a5f97237..de5c0032c7e6e 100644
--- a/lib/tests/modules/strMatching-merge.nix
+++ b/lib/tests/modules/strMatching-merge.nix
@@ -3,12 +3,12 @@
   imports = [
     {
       options.sm = lib.mkOption {
-        type = lib.types.strMatching "\(.*\)";
+        type = lib.types.strMatching "\\(.*\\)";
       };
     }
     {
       options.sm = lib.mkOption {
-        type = lib.types.strMatching "\(.*\)";
+        type = lib.types.strMatching "\\(.*\\)";
       };
     }
   ];
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index dc1120dda9169..b40818bc635f2 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -17,7 +17,7 @@ let
   offloadCfg = pCfg.offload;
   reverseSyncCfg = pCfg.reverseSync;
   primeEnabled = syncCfg.enable || reverseSyncCfg.enable || offloadCfg.enable;
-  busIDType = lib.types.strMatching "([[:print:]]+[\:\@][0-9]{1,3}\:[0-9]{1,2}\:[0-9])?";
+  busIDType = lib.types.strMatching "([[:print:]]+[\\:\\@][0-9]{1,3}\\:[0-9]{1,2}\\:[0-9])?";
   ibtSupport = useOpenModules || (nvidia_x11.ibtSupport or false);
   settingsFormat = pkgs.formats.keyValue { };
 in
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 6688ab9d1ca91..b1a58be8ef4cc 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -24,7 +24,7 @@ let
     ;
 
   needsEscaping = s: null != builtins.match "[a-zA-Z0-9]+" s;
-  escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "\$" "\"" "\\" "\`" ] s}"'';
+  escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "$" "\"" "\\" "`" ] s}"'';
   attrsToText =
     attrs:
     concatStringsSep "\n" (mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs)
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 4388be30a9350..70d215075bff9 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -93,7 +93,7 @@ let
   # The idea is to match everything that looks like `$term =`
   # but not `# $term something something`
   # or `# $term = some value` because those are comments.
-  configContainsSetting = lines: term: (match "^[^#]*\b${term}\b.*=" lines) != null;
+  configContainsSetting = lines: term: (match "^[^#]*\\b${term}\\b.*=" lines) != null;
 
   warnAboutExtraConfigCollisions = map mkExtraConfigCollisionWarning (
     filter (configContainsSetting cfg.extraConfig) automaticallySetPluginSettings
diff --git a/nixos/modules/services/misc/snapper.nix b/nixos/modules/services/misc/snapper.nix
index 42f782bcd6e18..2adf845a7a1b8 100644
--- a/nixos/modules/services/misc/snapper.nix
+++ b/nixos/modules/services/misc/snapper.nix
@@ -36,7 +36,7 @@ let
   };
 
   intOrNumberOrRange = lib.types.either lib.types.ints.unsigned (
-    lib.types.strMatching "[[:digit:]]+(\-[[:digit:]]+)?"
+    lib.types.strMatching "[[:digit:]]+(\\-[[:digit:]]+)?"
     // {
       description = "string containing either a number or a range";
       descriptionClass = "conjunction";
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix b/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix
index 0a3ceba88d201..5f85f86ec44f2 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix
@@ -13,7 +13,7 @@ let
     name = "goDuration";
     description = "Go duration (https://golang.org/pkg/time/#ParseDuration)";
     check =
-      x: types.str.check x && builtins.match "(-?[0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+" x != null;
+      x: types.str.check x && builtins.match "(-?[0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h))+" x != null;
     inherit (types.str) merge;
   };
 in
diff --git a/nixos/modules/services/networking/lxd-image-server.nix b/nixos/modules/services/networking/lxd-image-server.nix
index 98906262ce1eb..34f6ace072b2e 100644
--- a/nixos/modules/services/networking/lxd-image-server.nix
+++ b/nixos/modules/services/networking/lxd-image-server.nix
@@ -105,19 +105,19 @@ in
             };
 
             # Serve json files with content type header application/json
-            "~ \.json$" = {
+            "~ \\.json$" = {
               extraConfig = ''
                 add_header Content-Type application/json;
               '';
             };
 
-            "~ \.tar.xz$" = {
+            "~ \\.tar.xz$" = {
               extraConfig = ''
                 add_header Content-Type application/octet-stream;
               '';
             };
 
-            "~ \.tar.gz$" = {
+            "~ \\.tar.gz$" = {
               extraConfig = ''
                 add_header Content-Type application/octet-stream;
               '';
diff --git a/nixos/modules/services/security/certmgr.nix b/nixos/modules/services/security/certmgr.nix
index f3164072b6b51..c4f76dd70d600 100644
--- a/nixos/modules/services/security/certmgr.nix
+++ b/nixos/modules/services/security/certmgr.nix
@@ -126,7 +126,7 @@ in
               service = mkOption {
                 type = nullOr str;
                 default = null;
-                description = "The service on which to perform \<action\> after fetching.";
+                description = "The service on which to perform \\<action\\> after fetching.";
               };
 
               action = mkOption {
diff --git a/nixos/modules/services/video/frigate.nix b/nixos/modules/services/video/frigate.nix
index a40ef748f1f5c..556b51ed23e40 100644
--- a/nixos/modules/services/video/frigate.nix
+++ b/nixos/modules/services/video/frigate.nix
@@ -408,7 +408,7 @@ in
               }
             '';
           };
-          "~* /api/.*\.(jpg|jpeg|png|webp|gif)$" = {
+          "~* /api/.*\\.(jpg|jpeg|png|webp|gif)$" = {
             proxyPass = "http://frigate-api";
             recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
diff --git a/nixos/modules/services/web-apps/agorakit.nix b/nixos/modules/services/web-apps/agorakit.nix
index f8c9f1db370bb..583f68ee5881f 100644
--- a/nixos/modules/services/web-apps/agorakit.nix
+++ b/nixos/modules/services/web-apps/agorakit.nix
@@ -367,10 +367,10 @@ in
               index = "index.php";
               tryFiles = "$uri $uri/ /index.php?$query_string";
             };
-            "~ \.php$".extraConfig = ''
+            "~ \\.php$".extraConfig = ''
               fastcgi_pass unix:${config.services.phpfpm.pools."agorakit".socket};
             '';
-            "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
               extraConfig = "expires 365d;";
             };
           };
diff --git a/nixos/modules/services/web-apps/castopod.nix b/nixos/modules/services/web-apps/castopod.nix
index fae20df530ef6..018dafd07bdaf 100644
--- a/nixos/modules/services/web-apps/castopod.nix
+++ b/nixos/modules/services/web-apps/castopod.nix
@@ -328,7 +328,7 @@ in
           '';
         };
 
-        locations."~ \.php$" = {
+        locations."~ \\.php$" = {
           fastcgiParams = {
             SERVER_NAME = "$host";
           };
diff --git a/nixos/modules/services/web-apps/davis.nix b/nixos/modules/services/web-apps/davis.nix
index 621f2ff20e2bb..a2c4c49108ef0 100644
--- a/nixos/modules/services/web-apps/davis.nix
+++ b/nixos/modules/services/web-apps/davis.nix
@@ -496,7 +496,7 @@ in
                     return 302 https://$host/dav/;
                   '';
                 };
-                "~ ^(.+\.php)(.*)$" = {
+                "~ ^(.+\\.php)(.*)$" = {
                   extraConfig = ''
                     try_files                $fastcgi_script_name =404;
                     include                  ${config.services.nginx.package}/conf/fastcgi_params;
diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix
index 45a36138ff542..d91249aa0ddf9 100644
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -925,7 +925,7 @@ in
             };
             "~ ^/uploads/short-url/" = proxy { };
             "~ ^/secure-media-uploads/" = proxy { };
-            "~* (fonts|assets|plugins|uploads)/.*\.(eot|ttf|woff|woff2|ico|otf)$".extraConfig =
+            "~* (fonts|assets|plugins|uploads)/.*\\.(eot|ttf|woff|woff2|ico|otf)$".extraConfig =
               cache_1y
               + ''
                 add_header Access-Control-Allow-Origin *;
diff --git a/nixos/modules/services/web-apps/dokuwiki.nix b/nixos/modules/services/web-apps/dokuwiki.nix
index d6ca14c40ef97..b63f38d6c7b29 100644
--- a/nixos/modules/services/web-apps/dokuwiki.nix
+++ b/nixos/modules/services/web-apps/dokuwiki.nix
@@ -436,7 +436,7 @@ in
             extraConfig = "internal;";
           };
 
-          "~ ^/lib.*\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+          "~ ^/lib.*\\.(js|css|gif|png|ico|jpg|jpeg)$" = {
             extraConfig = "expires 365d;";
           };
 
diff --git a/nixos/modules/services/web-apps/firefly-iii-data-importer.nix b/nixos/modules/services/web-apps/firefly-iii-data-importer.nix
index cbf089ce2fb75..1370e05585388 100644
--- a/nixos/modules/services/web-apps/firefly-iii-data-importer.nix
+++ b/nixos/modules/services/web-apps/firefly-iii-data-importer.nix
@@ -239,7 +239,7 @@ in
               sendfile off;
             '';
           };
-          "~ \.php$" = {
+          "~ \\.php$" = {
             extraConfig = ''
               include ${config.services.nginx.package}/conf/fastcgi_params ;
               fastcgi_param SCRIPT_FILENAME $request_filename;
diff --git a/nixos/modules/services/web-apps/firefly-iii.nix b/nixos/modules/services/web-apps/firefly-iii.nix
index 42d6cdcb06b37..436e1228e6fc9 100644
--- a/nixos/modules/services/web-apps/firefly-iii.nix
+++ b/nixos/modules/services/web-apps/firefly-iii.nix
@@ -361,7 +361,7 @@ in
               sendfile off;
             '';
           };
-          "~ \.php$" = {
+          "~ \\.php$" = {
             extraConfig = ''
               include ${config.services.nginx.package}/conf/fastcgi_params ;
               fastcgi_param SCRIPT_FILENAME $request_filename;
diff --git a/nixos/modules/services/web-apps/flarum.nix b/nixos/modules/services/web-apps/flarum.nix
index d7f558c73d07e..c466d2700b1c7 100644
--- a/nixos/modules/services/web-apps/flarum.nix
+++ b/nixos/modules/services/web-apps/flarum.nix
@@ -164,7 +164,7 @@ in
       enable = true;
       virtualHosts."${cfg.domain}" = {
         root = "${cfg.stateDir}/public";
-        locations."~ \.php$".extraConfig = ''
+        locations."~ \\.php$".extraConfig = ''
           fastcgi_pass unix:${config.services.phpfpm.pools.flarum.socket};
           fastcgi_index site.php;
         '';
diff --git a/nixos/modules/services/web-apps/freshrss.nix b/nixos/modules/services/web-apps/freshrss.nix
index 0e8bcc703efa9..41a45d0690f99 100644
--- a/nixos/modules/services/web-apps/freshrss.nix
+++ b/nixos/modules/services/web-apps/freshrss.nix
@@ -211,7 +211,7 @@ in
 
           # php files handling
           # this regex is mandatory because of the API
-          locations."~ ^.+?\.php(/.*)?$".extraConfig = ''
+          locations."~ ^.+?\\.php(/.*)?$".extraConfig = ''
             fastcgi_pass unix:${config.services.phpfpm.pools.${cfg.pool}.socket};
             fastcgi_split_path_info ^(.+\.php)(/.*)$;
             # By default, the variable PATH_INFO is not set under PHP-FPM
diff --git a/nixos/modules/services/web-apps/monica.nix b/nixos/modules/services/web-apps/monica.nix
index 6774e2c9bb467..aaa7b7a56f14f 100644
--- a/nixos/modules/services/web-apps/monica.nix
+++ b/nixos/modules/services/web-apps/monica.nix
@@ -355,10 +355,10 @@ in {
               index = "index.php";
               tryFiles = "$uri $uri/ /index.php?$query_string";
             };
-            "~ \.php$".extraConfig = ''
+            "~ \\.php$".extraConfig = ''
               fastcgi_pass unix:${config.services.phpfpm.pools."monica".socket};
             '';
-            "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
               extraConfig = "expires 365d;";
             };
           };
diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index d56a4d66283cf..f56dfd341dcc6 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -105,27 +105,27 @@ in
         virtualHosts.${cfg.hostname} = {
           locations = {
             # /etc/nginx/includes/ds-docservice.conf
-            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps\/apps\/api\/documents\/api\.js)$".extraConfig =
+            "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\d]+)?\\/(web-apps\\/apps\\/api\\/documents\\/api\\.js)$".extraConfig =
               ''
                 expires -1;
                 alias ${cfg.package}/var/www/onlyoffice/documentserver/$2;
               '';
-            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps)(\/.*\.json)$".extraConfig = ''
+            "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\d]+)?\\/(web-apps)(\\/.*\\.json)$".extraConfig = ''
               expires 365d;
               error_log /dev/null crit;
               alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
             '';
-            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(sdkjs-plugins)(\/.*\.json)$".extraConfig = ''
+            "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\d]+)?\\/(sdkjs-plugins)(\\/.*\\.json)$".extraConfig = ''
               expires 365d;
               error_log /dev/null crit;
               alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
             '';
-            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(web-apps|sdkjs|sdkjs-plugins|fonts)(\/.*)$".extraConfig =
+            "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\d]+)?\\/(web-apps|sdkjs|sdkjs-plugins|fonts)(\\/.*)$".extraConfig =
               ''
                 expires 365d;
                 alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
               '';
-            "~* ^(\/cache\/files.*)(\/.*)".extraConfig = ''
+            "~* ^(\\/cache\\/files.*)(\\/.*)".extraConfig = ''
               alias /var/lib/onlyoffice/documentserver/App_Data$1;
               add_header Content-Disposition "attachment; filename*=UTF-8''$arg_filename";
 
@@ -141,12 +141,12 @@ in
                 return 410;
               }
             '';
-            "~* ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(internal)(\/.*)$".extraConfig = ''
+            "~* ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\d]+)?\\/(internal)(\\/.*)$".extraConfig = ''
               allow 127.0.0.1;
               deny all;
               proxy_pass http://onlyoffice-docservice/$2$3;
             '';
-            "~* ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(info)(\/.*)$".extraConfig = ''
+            "~* ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\d]+)?\\/(info)(\\/.*)$".extraConfig = ''
               allow 127.0.0.1;
               deny all;
               proxy_pass http://onlyoffice-docservice/$2$3;
@@ -154,19 +154,19 @@ in
             "/".extraConfig = ''
               proxy_pass http://onlyoffice-docservice;
             '';
-            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?(\/doc\/.*)".extraConfig = ''
+            "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\d]+)?(\\/doc\\/.*)".extraConfig = ''
               proxy_pass http://onlyoffice-docservice$2;
               proxy_http_version 1.1;
             '';
             "/${cfg.package.version}/".extraConfig = ''
               proxy_pass http://onlyoffice-docservice/;
             '';
-            "~ ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(dictionaries)(\/.*)$".extraConfig = ''
+            "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\d]+)?\\/(dictionaries)(\\/.*)$".extraConfig = ''
               expires 365d;
               alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;
             '';
             # /etc/nginx/includes/ds-example.conf
-            "~ ^(\/welcome\/.*)$".extraConfig = ''
+            "~ ^(\\/welcome\\/.*)$".extraConfig = ''
               expires 365d;
               alias ${cfg.package}/var/www/onlyoffice/documentserver-example$1;
               index docker.html;
diff --git a/nixos/modules/services/web-apps/peertube.nix b/nixos/modules/services/web-apps/peertube.nix
index b61344a95db88..f52a4ccf6266f 100644
--- a/nixos/modules/services/web-apps/peertube.nix
+++ b/nixos/modules/services/web-apps/peertube.nix
@@ -696,7 +696,7 @@ in
         };
 
         # Bypass PeerTube for performance reasons.
-        locations."~ ^/client/(assets/images/(icons/icon-36x36\.png|icons/icon-48x48\.png|icons/icon-72x72\.png|icons/icon-96x96\.png|icons/icon-144x144\.png|icons/icon-192x192\.png|icons/icon-512x512\.png|logo\.svg|favicon\.png|default-playlist\.jpg|default-avatar-account\.png|default-avatar-account-48x48\.png|default-avatar-video-channel\.png|default-avatar-video-channel-48x48\.png))$" =
+        locations."~ ^/client/(assets/images/(icons/icon-36x36\\.png|icons/icon-48x48\\.png|icons/icon-72x72\\.png|icons/icon-96x96\\.png|icons/icon-144x144\\.png|icons/icon-192x192\\.png|icons/icon-512x512\\.png|logo\\.svg|favicon\\.png|default-playlist\\.jpg|default-avatar-account\\.png|default-avatar-account-48x48\\.png|default-avatar-video-channel\\.png|default-avatar-video-channel-48x48\\.png))$" =
           {
             tryFiles = "/client-overrides/$1 /client/$1 $1";
             priority = 1310;
@@ -704,7 +704,7 @@ in
             extraConfig = nginxCommonHeaders;
           };
 
-        locations."~ ^/client/(.*\.(js|css|png|svg|woff2|otf|ttf|woff|eot))$" = {
+        locations."~ ^/client/(.*\\.(js|css|png|svg|woff2|otf|ttf|woff|eot))$" = {
           alias = "${cfg.package}/client/dist/$1";
           priority = 1320;
           extraConfig =
diff --git a/nixos/modules/services/web-apps/privatebin.nix b/nixos/modules/services/web-apps/privatebin.nix
index 4315664dabc20..ea1d9933d0b78 100644
--- a/nixos/modules/services/web-apps/privatebin.nix
+++ b/nixos/modules/services/web-apps/privatebin.nix
@@ -186,7 +186,7 @@ in
               sendfile off;
             '';
           };
-          "~ \.php$" = {
+          "~ \\.php$" = {
             extraConfig = ''
               include ${config.services.nginx.package}/conf/fastcgi_params ;
               fastcgi_param SCRIPT_FILENAME $request_filename;
diff --git a/nixos/modules/services/web-apps/rutorrent.nix b/nixos/modules/services/web-apps/rutorrent.nix
index 8cbda677c2b12..be2af96ae05b6 100644
--- a/nixos/modules/services/web-apps/rutorrent.nix
+++ b/nixos/modules/services/web-apps/rutorrent.nix
@@ -305,7 +305,7 @@ in
               ${cfg.hostName} = {
                 root = cfg.dataDir;
                 locations = {
-                  "~ [^/]\.php(/|$)" = {
+                  "~ [^/]\\.php(/|$)" = {
                     extraConfig = ''
                       fastcgi_split_path_info ^(.+?\.php)(/.*)$;
                       if (!-f $document_root$fastcgi_script_name) {
diff --git a/nixos/modules/services/web-apps/snipe-it.nix b/nixos/modules/services/web-apps/snipe-it.nix
index e9a68006ae646..07163d08d9b63 100644
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@@ -368,7 +368,7 @@ in {
             index = "index.php";
             extraConfig = ''try_files $uri $uri/ /index.php?$query_string;'';
           };
-          "~ \.php$" = {
+          "~ \\.php$" = {
             extraConfig = ''
               try_files $uri $uri/ /index.php?$query_string;
               include ${config.services.nginx.package}/conf/fastcgi_params;
@@ -378,7 +378,7 @@ in {
               ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;"}
             '';
           };
-          "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
             extraConfig = "expires 365d;";
           };
         };
diff --git a/nixos/modules/services/web-apps/zabbix.nix b/nixos/modules/services/web-apps/zabbix.nix
index 3463148b30e0d..5c9a5865e759a 100644
--- a/nixos/modules/services/web-apps/zabbix.nix
+++ b/nixos/modules/services/web-apps/zabbix.nix
@@ -342,7 +342,7 @@ in
             index = "index.html index.htm index.php";
             tryFiles = "$uri $uri/ =404";
           };
-          locations."~ \.php$".extraConfig = ''
+          locations."~ \\.php$".extraConfig = ''
             fastcgi_pass  unix:${fpm.socket};
             fastcgi_index index.php;
           '';
diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix
index 3e964ef53266d..3d069c04ed146 100644
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -155,7 +155,7 @@ in
       };
 
       background = mkOption {
-        type = types.either types.path (types.strMatching "^#[0-9]\{6\}$");
+        type = types.either types.path (types.strMatching "^#[0-9]\\{6\\}$");
         # Manual cannot depend on packages, we are actually setting the default in config below.
         defaultText = literalExpression "pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom.gnomeFilePath";
         description = ''