{pkgs, ...}: {
  security.sudo.enable = false;

  environment.systemPackages = [
    pkgs.doas-sudo-shim
  ];
  security.doas = {
    enable = true;
    extraRules = [
      {
        # invoke just with doas directly as a nixos-rebuild helper
        users = [":wheel"];
        setEnv = ["PATH"];
        cmd = "just";
      }
    ];
  };
}