diff --git a/common/global/default.nix b/common/global/default.nix
index 1f1e3d7..4487cae 100644
--- a/common/global/default.nix
+++ b/common/global/default.nix
@@ -56,7 +56,13 @@
 
   programs.zsh.enable = true;
 
-  security.auditd.enable = lib.mkDefault true;
+  security = {
+    auditd.enable = lib.mkDefault true;
+    sudo-rs = {
+      enable = true;
+      execWheelOnly = true;
+    };
+  };
 
   users.mutableUsers = lib.mkDefault false;