diff --git a/config/base.nix b/config/base.nix
index 435c8aa..1acfbe2 100644
--- a/config/base.nix
+++ b/config/base.nix
@@ -47,9 +47,16 @@
   };
   security = {
     polkit.enable = true;
-    sudo = {
+    sudo.enable = false;
+    doas = {
       enable = true;
       wheelNeedsPassword = false;
+      extraRules = [
+        {
+          keepEnv = true;
+          persist = true;
+        }
+      ];
     };
     pam.loginLimits = [
       {