reNixos/kyra/security/sudo-rs.nix

_: {
  security = {
    sudo-rs = {
      enable = true;
      wheelNeedsPassword = true;
      execWheelOnly = true;
    };
  };
}