nixpkgs overlay for supplying extra flags to the qemu used in nixos' `boot.binfmt.emulatedSystems`. Note these specific flags used in this example are architecture-specific, but the flags are applied globally so this wouldn't work if emulating multiple architectures at once on the same system.

extra-binfmt-flags.nix

(final: prev: {
  wrapQemuBinfmtP = name: emulator:
    prev.wrapQemuBinfmtP name (
      pkgs.runCommand "${name}-arg-wrapper" {
        nativeBuildInputs = [ final.pkgsStatic.makeBinaryWrapper ];
      } ''
        makeWrapper ${emulator} $out --add-flags '-cpu max,pauth-impdef=on'
      ''
    );
})