diff --git a/kyra/security/sudo-rs.nix b/kyra/security/sudo-rs.nix
new file mode 100644
index 0000000..4f270c9
--- /dev/null
+++ b/kyra/security/sudo-rs.nix
@@ -0,0 +1,9 @@
+_: {
+  security = {
+    sudo-rs = {
+      enable = true;
+      wheelNeedsPassword = true;
+      execWheelOnly = true;
+    };
+  };
+}
diff --git a/kyra/security/sudo.nix b/kyra/security/sudo.nix
new file mode 100644
index 0000000..393528d
--- /dev/null
+++ b/kyra/security/sudo.nix
@@ -0,0 +1,7 @@
+{lib, ...}: {
+  security = {
+    sudo = {
+      enable = lib.mkDefault false;
+    };
+  };
+}