reNixos/s0meMiniPC-nix/security/sudo-rs.nix

{...}: {
  security = {
    sudo-rs = {
      enable = true;
      wheelNeedsPassword = true;
      execWheelOnly = true;
    };
  };
}