diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index 51877970a8bc..e586af25c2b1 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -53,7 +53,7 @@ in {
 
       blacklistPlugins = mkOption {
         type = types.listOf types.str;
-        default = [ "test" ];
+        default = [];
         example = [ "udev" ];
         description = ''
           Allow blacklisting specific plugins
@@ -91,6 +91,9 @@ in {
 
   ###### implementation
   config = mkIf cfg.enable {
+    # Disable test related plug-ins implicitly so that users do not have to care about them.
+    services.fwupd.blacklistPlugins = cfg.package.defaultBlacklistedPlugins;
+
     environment.systemPackages = [ cfg.package ];
 
     environment.etc = {
diff --git a/nixos/tests/installed-tests/fwupd.nix b/nixos/tests/installed-tests/fwupd.nix
index b9f761e99582..6a0ceb57dda4 100644
--- a/nixos/tests/installed-tests/fwupd.nix
+++ b/nixos/tests/installed-tests/fwupd.nix
@@ -1,11 +1,11 @@
-{ pkgs, makeInstalledTest, ... }:
+{ pkgs, lib, makeInstalledTest, ... }:
 
 makeInstalledTest {
   tested = pkgs.fwupd;
 
   testConfig = {
     services.fwupd.enable = true;
-    services.fwupd.blacklistPlugins = []; # don't blacklist test plugin
+    services.fwupd.blacklistPlugins = lib.mkForce []; # don't blacklist test plugin
     services.fwupd.enableTestRemote = true;
     virtualisation.memorySize = 768;
   };
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 280145a6838e..eac2ed4acd00 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -1,4 +1,4 @@
-# Updating? Keep $out/etc synchronized with passthru.filesInstalledToEtc
+# Updating? Keep $out/etc synchronized with passthru keys
 
 { stdenv
 , fetchurl
@@ -94,7 +94,10 @@ stdenv.mkDerivation rec {
     sha256 = "02mzn3whk5mba4nxyrkypawr1gzjx79n4nrkhrp8vja6mxxgsf10";
   };
 
-  outputs = [ "out" "dev" "devdoc" "man" "installedTests" ];
+  # libfwupd goes to lib
+  # daemon, plug-ins and libfwupdplugin go to out
+  # CLI programs go to out
+  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
 
   nativeBuildInputs = [
     meson
@@ -148,6 +151,10 @@ stdenv.mkDerivation rec {
     ./fix-paths.patch
     ./add-option-for-installation-sysconfdir.patch
 
+    # install plug-ins and libfwupdplugin to out,
+    # they are not really part of the library
+    ./install-fwupdplugin-to-out.patch
+
     # installed tests are installed to different output
     # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle
     (substituteAll {
@@ -203,6 +210,12 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
     "--sysconfdir=/etc"
     "-Dsysconfdir_install=${placeholder "out"}/etc"
+
+    # We do not want to place the daemon into lib (cyclic reference)
+    "--libexecdir=${placeholder "out"}/libexec"
+    # Our builder only adds $lib/lib to rpath but some things link
+    # against libfwupdplugin which is in $out/lib.
+    "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
   ] ++ stdenv.lib.optionals (!haveDell) [
     "-Dplugin_dell=false"
     "-Dplugin_synaptics=false"
@@ -261,6 +274,12 @@ stdenv.mkDerivation rec {
       "pki/fwupd-metadata/LVFS-CA.pem"
     ];
 
+    # BlacklistPlugins key in fwupd/daemon.conf
+    defaultBlacklistedPlugins = [
+      "test"
+      "invalid"
+    ];
+
     tests = {
       installedTests = nixosTests.installed-tests.fwupd;
     };
diff --git a/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch b/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
new file mode 100644
index 000000000000..347b6862146d
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
@@ -0,0 +1,37 @@
+diff --git a/libfwupdplugin/meson.build b/libfwupdplugin/meson.build
+index 0abcd45c..51cbc912 100644
+--- a/libfwupdplugin/meson.build
++++ b/libfwupdplugin/meson.build
+@@ -114,7 +114,8 @@
+   ],
+   link_args : vflag,
+   link_depends : fwupdplugin_mapfile,
+-  install : true
++  install : true,
++  install_dir : bindir / '..' / 'lib',
+ )
+ 
+ fwupdplugin_pkgg = import('pkgconfig')
+@@ -167,7 +168,8 @@
+       'GUsb-1.0',
+       fwupd_gir[0],
+     ],
+-    install : true
++    install : true,
++    install_dir_typelib : bindir / '..' / 'lib' / 'girepository-1.0',
+   )
+   gnome.generate_vapi('fwupdplugin',
+     sources : fwupd_gir[0],
+diff --git a/meson.build b/meson.build
+index b1a523d2..00125997 100644
+--- a/meson.build
++++ b/meson.build
+@@ -389,7 +389,7 @@
+ if host_machine.system() == 'windows'
+   plugin_dir = 'fwupd-plugins-3'
+ else
+-  plugin_dir = join_paths(libdir, 'fwupd-plugins-3')
++  plugin_dir = join_paths(bindir, '..', 'lib', 'fwupd-plugins-3')
+ endif
+ conf.set_quoted('FWUPD_PLUGINDIR', plugin_dir)
+ endif