{
  security.sudo.extraConfig = ''
    Defaults        lecture = always
  '';
}