{
  config,
  lib,
  options,
  pkgs,
  ...
}:
{
  security = {
    doas.extraRules = [
      {
        groups = [ "wheel" ];
      }
      {
        cmd = "mount";
        groups = [ "wheel" ];
        noPass = true;
      }
    ];

    sudo.enable = lib.mkDefault (!config.security.doas.enable);
  };
}