diff --git a/hosts/hyrule/default.nix b/hosts/hyrule/default.nix
index dc5cfb2..04dd0ad 100755
--- a/hosts/hyrule/default.nix
+++ b/hosts/hyrule/default.nix
@@ -72,8 +72,6 @@ in {
     };
   };
 
-  security.sudo.wheelNeedsPassword = false;
-
   users = {
     defaultUserShell = pkgs.bash;
 
@@ -418,9 +416,10 @@ in {
       defaults.email = "eclarkboman@gmail.com";
     };
 
+    sudo.wheelNeedsPassword = true;
     # allow SSH keys for passwordless auth
     # TODO: DO NOT USE THIS (create my own alternative to colmena)
-    pam.services.sudo.sshAgentAuth = true;
+    pam.services.sudo.sshAgentAuth = true; # pam_ssh_agent_auth module
   };
 
   environment.systemPackages = with pkgs; [