{
  config,
  lib,
  options,
  ...
}:
{
  security = {
    doas.extraRules = [ { groups = [ "wheel" ]; } ];
    sudo.enable = lib.mkDefault (!config.security.doas.enable);
  };
}