bootconf.txt

[all]
BOOT_UART=1
WAKE_ON_GPIO=1
POWER_OFF_ON_HALT=0
DHCP_TIMEOUT=45000
DHCP_REQ_TIMEOUT=4000
TFTP_FILE_TIMEOUT=30000
TFTP_IP=
TFTP_PREFIX=0
SD_BOOT_MAX_RETRIES=3
NET_BOOT_MAX_RETRIES=5
BOOT_ORDER=0x41

[none]
FREEZE_VERSION=1

default.nix

let
  nixpkgs = builtins.fetchTarball "https://github.com/nixos/nixpkgs/archive/038afc6.tar.gz";
  pkgs = import nixpkgs {};
in {
  changeConfig = { bootconf, eeprom, ts }:
  pkgs.runCommand "eeprom.img" {
    buildInputs = [ pkgs.raspberrypi-eeprom ];
  } ''
    cp ${eeprom} pieeprom.bin
    mkdir $out
    # Apply config
    rpi-eeprom-config --config ${bootconf} --out $out/pieeprom.bin pieeprom.bin
    sha256sum $out/pieeprom.bin | cut -d' ' -f1 > $out/pieeprom.sig
    echo 'ts: ${ts}' >> $out/pieeprom.sig
  '';
}

https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md

[clever@amd-nixos:~/apps/rpi/rpi-eeprom/firmware/beta]$ git remote -v
origin  https://github.com/raspberrypi/rpi-eeprom (fetch)
origin  https://github.com/raspberrypi/rpi-eeprom (push)
[clever@amd-nixos:~/apps/rpi/rpi-eeprom/firmware/beta]$ nix-build -A changeConfig --arg eeprom ./pieeprom-2020-09-03.bin --arg bootconf ./bootconf.txt
[clever@amd-nixos:~/apps/rpi/rpi-eeprom/firmware/beta]$ ls -lh result/
total 281K
-r--r--r-- 1 root root 512K Dec 31  1969 pieeprom.bin
-r--r--r-- 1 root root   65 Dec 31  1969 pieeprom.sig