TIL that by default NixOS configures glibc's "Name Service Cache Daemon" but... tells it not to cache?
Turns out that NixOS uses nscd not for its original purpose, of caching passwd/group/hosts queries when they involve slow LDAP or NIS network requests... but instead just to have one single process that knows where the NSS ("Name Service Switch") plugin libraries are, so that nothing else on the system has to be configured to be able to find them.
Which I think is both clever and horrifying, in equal measure?