diff --git a/pkgs/test/config.nix b/pkgs/test/config.nix
new file mode 100644
index 000000000000..6047b013206a
--- /dev/null
+++ b/pkgs/test/config.nix
@@ -0,0 +1,21 @@
+{ lib, ... }:
+lib.recurseIntoAttrs {
+
+  # https://github.com/NixOS/nixpkgs/issues/175196
+  allowPkgsInPermittedInsecurePackages =
+    let pkgs = import ../.. {
+          config = {
+            permittedInsecurePackages =
+              tempAllow pkgs.authy "2.1.0" [ "electron-9.4.4" ];
+          };
+        };
+        # Allow with forgetting
+        tempAllow = p: v: pa:
+          lib.optionals (lib.assertMsg (p.version == v) "${p.name} is no longer at version ${v}, consider removing the tempAllow") pa;
+        # For this test we don't _really_ care about the version though,
+        # only about evaluation strictness
+        tempAllowAlike = p: v: pa: builtins.seq v builtins.seq p.version pa;
+
+    in pkgs.hello;
+
+}
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index ab235d610025..48bd6ac77469 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -22,6 +22,8 @@ with pkgs;
   cc-wrapper-libcxx-9 = callPackage ./cc-wrapper { stdenv = llvmPackages_9.libcxxStdenv; };
   stdenv-inputs = callPackage ./stdenv-inputs { };
 
+  config = callPackage ./config.nix { };
+
   haskell = callPackage ./haskell { };
 
   cc-multilib-gcc = callPackage ./cc-wrapper/multilib.nix { stdenv = gccMultiStdenv; };
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index ad06227e74f1..e038973e0858 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -128,7 +128,7 @@ let
 in {
 
   freeformType =
-    let t = lib.types.attrsOf lib.types.raw;
+    let t = lib.types.lazyAttrsOf lib.types.raw;
     in t // {
       merge = loc: defs:
         let r = t.merge loc defs;