Good luck! With NixOS I don't worry about such things any longer.

Happened to me with gentoo, i use arch btw now with flathub to install packs to minimize this kind of issues

I moved my arch installed to systemd-boot.

I've gone an entire year without updating one of my test servers, and months on other test machines.

My go-to is always the same and has worked everytime - Update the keyring package alone prior to any other updates. Flawless.

As a Gentoo user, I sympathize.