{
  ...
}:
{
  security.sudo.execWheelOnly = true;
}