Seems like Homebrew taps need additional configuration now; this error happens on rebuild when a formula/cask from a tap is included in the system config:

{
    homebrew.brews = [
        {
            name = "OoTRandomizer/tap/n64";
            args = [ "head" ];
        }
    ];
}

Error: Refusing to load formula ootrandomizer/tap/n64 from untrusted tap ootrandomizer/tap.
Run `brew trust --formula ootrandomizer/tap/n64` or `brew trust ootrandomizer/tap` to trust it.

A similar error also occurs with casks.

I tried specifying homebrew.taps = [ "OoTRandomizer/tap" ] but that didn't fix the error.

The brew trust command does fix the error, but a declarative fix would be better.