diff --git a/nixos/modules/security/auditd.nix b/nixos/modules/security/auditd.nix
index 3d07a1d93809..ff20cc2fbbf7 100644
--- a/nixos/modules/security/auditd.nix
+++ b/nixos/modules/security/auditd.nix
@@ -143,6 +143,39 @@ in
     plugins = lib.mkOption {
       type = lib.types.attrsOf pluginOptions;
       default = { };
+      defaultText = lib.literalExpression ''
+        {
+          af_unix = {
+            path = lib.getExe' pkgs.audit "audisp-af_unix";
+            args = [
+              "0640"
+              "/var/run/audispd_events"
+              "string"
+            ];
+            format = "binary";
+          };
+          remote = {
+            path = lib.getExe' pkgs.audit "audisp-remote";
+            settings = { };
+          };
+          filter = {
+            path = lib.getExe' pkgs.audit "audisp-filter";
+            args = [
+              "allowlist"
+              "/etc/audit/audisp-filter.conf"
+              (lib.getExe' pkgs.audit "audisp-syslog")
+              "LOG_USER"
+              "LOG_INFO"
+              "interpret"
+            ];
+            settings = { };
+          };
+          syslog = {
+            path = lib.getExe' pkgs.audit "audisp-syslog";
+            args = [ "LOG_INFO" ];
+          };
+        }
+      '';
       description = "Plugin definitions to register with auditd";
     };
   };
@@ -193,6 +226,38 @@ in
       }
     ) (lib.filterAttrs (_: v: v.settings != null) cfg.plugins));
 
+    security.auditd.plugins = {
+      af_unix = {
+        path = lib.getExe' pkgs.audit "audisp-af_unix";
+        args = [
+          "0640"
+          "/var/run/audispd_events"
+          "string"
+        ];
+        format = "binary";
+      };
+      remote = {
+        path = lib.getExe' pkgs.audit "audisp-remote";
+        settings = { };
+      };
+      filter = {
+        path = lib.getExe' pkgs.audit "audisp-filter";
+        args = [
+          "allowlist"
+          "/etc/audit/audisp-filter.conf"
+          (lib.getExe' pkgs.audit "audisp-syslog")
+          "LOG_USER"
+          "LOG_INFO"
+          "interpret"
+        ];
+        settings = { };
+      };
+      syslog = {
+        path = lib.getExe' pkgs.audit "audisp-syslog";
+        args = [ "LOG_INFO" ];
+      };
+    };
+
     systemd.services.auditd = {
       description = "Security Audit Logging Service";
       documentation = [ "man:auditd(8)" ];