diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 1ed4e20b9a59..2e8d17d872d2 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -40,10 +40,11 @@ let
     polkit.addRule(function(action, subject) {
       if (
         subject.isInGroup("networkmanager")
+        && subject.active
         && (action.id.indexOf("org.freedesktop.NetworkManager.") == 0
             || action.id.indexOf("org.freedesktop.ModemManager.")  == 0
         ))
-          { return polkit.Result.YES; } #TODO: active/inactive
+          { return polkit.Result.YES; }
     });
   '';
 
@@ -189,8 +190,7 @@ in {
       systemctl restart NetworkManager
     '';
 
-    #TODO
-    #security.polkit.permissions = polkitConf;
+    security.polkit.extraConfig = polkitConf;
 
     # openvpn plugin has only dbus interface
     services.dbus.packages = cfg.packages ++ [