Indeed, the NixOS module works well. I just tried it:

    services.paperless.enable = true;

In contrast to Docker, it composes well with other things on the same system (e.g. the Samba server already set up to receive documents from my scanner), and I get automatic security updates for it.