Nix combined with a tmpfs root fixes this. You have no choice but to opt-in to state, or you lose it.

https://grahamc.com/blog/erase-your-darlings