diff --git a/nixos/modules/services/networking/adguardhome.nix b/nixos/modules/services/networking/adguardhome.nix
index caab4ba0c953..5d6c4459aa8e 100644
--- a/nixos/modules/services/networking/adguardhome.nix
+++ b/nixos/modules/services/networking/adguardhome.nix
@@ -20,8 +20,7 @@ let
 
   settings =
     if (cfg.settings != null) then
-      cfg.settings
-      // (
+      lib.recursiveUpdate cfg.settings (
         if cfg.settings.schema_version < 23 then
           {
             bind_host = cfg.host;
@@ -192,8 +191,9 @@ in
                 # Note: --check-config has the side effect of modifying the file at rest!
                 ${lib.getExe cfg.package} -c "$STATE_DIRECTORY/AdGuardHome.yaml" --check-config
 
-                # Writing directly to AdGuardHome.yaml results in empty file
-                ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
+                # sed operation needed to fix protection_disabled_until value changed by yaml-merge
+                ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" \
+                | sed -E "s/(protection_disabled_until: [0-9]{4}-[0-9]{2}-[0-9]{2}) /\1T/" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
                 mv "$STATE_DIRECTORY/AdGuardHome.yaml.tmp" "$STATE_DIRECTORY/AdGuardHome.yaml"
               else
                 ${installFresh}