{ ... }: { security.sudo-rs = { enable = true; execWheelOnly = true; }; }