diff --git a/modules/clan/gw-router/default.nix b/modules/clan/gw-router/default.nix
index 5231b6c..07c88b6 100644
--- a/modules/clan/gw-router/default.nix
+++ b/modules/clan/gw-router/default.nix
@@ -133,14 +133,16 @@
           };
 
           accessPorts = lib.mkOption {
-            type = lib.types.attrsOf lib.types.submodule {
-              options = {
-                vlanId = lib.mkOption {
-                  type = lib.types.int;
-                  description = "Untagged traffic in from the device gets tagged VLANs inside the bridge, and VLANs traffic going back out to the device gets untagged, so the device itself never has to know VLANs exist.";
+            type = lib.types.attrsOf (
+              lib.types.submodule {
+                options = {
+                  vlanId = lib.mkOption {
+                    type = lib.types.int;
+                    description = "Untagged traffic in from the device gets tagged VLANs inside the bridge, and VLANs traffic going back out to the device gets untagged, so the device itself never has to know VLANs exist.";
+                  };
                 };
-              };
-            };
+              }
+            );
             description = ''
               Ports acting as untagged access ports on a single VLAN (port name ->
               VLAN id). Frames are untagged on the wire; the bridge tags them with