reNixos/s0melapt0p-nix/security/sudo-rs.nix

{...}: {
    security = {
        sudo-rs = {
            enable = true;
            wheelNeedsPassword = true;
            execWheelOnly = true;
        };
    };
}