Referencing runtime closures in NixOS config

I’m toying with the somewhat novel idea of running least-privileged/hardened services. One of the cooler options systemd exposes is RootDirectory, which runs the service in a chroot where paths can then be bind-mounted into. Most of the examples (or, the one on the wiki, anyway) shows using builtins.storeDir to just mount the entire Nix store, which is fine, but limiting to exactly what a service requires would be better. TLDR: I basically want nix-store -q --requisites ${pkgs.somepackage} duri...