diff --git a/modules/common/users.nix b/modules/common/users.nix
index 5d65284..0051e3f 100644
--- a/modules/common/users.nix
+++ b/modules/common/users.nix
@@ -5,6 +5,10 @@
   hostname,
   ...
 } @ args: {
+  imports = [
+    ../security/sudo.nix
+  ];
+
   networking.hostName = hostname;
 
   # Don't forget to set a password with ‘passwd’!
diff --git a/modules/security/README.md b/modules/security/README.md
new file mode 100644
index 0000000..51e9735
--- /dev/null
+++ b/modules/security/README.md
@@ -0,0 +1,3 @@
+# Security modules
+
+These are modules relating to security and security-related programs
diff --git a/modules/security/sudo.nix b/modules/security/sudo.nix
new file mode 100644
index 0000000..9f0b04f
--- /dev/null
+++ b/modules/security/sudo.nix
@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  options = {
+    security.sudo = {
+      wheelNeedsPassword = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether users in the wheel group need to provide a password for sudo.";
+      };
+    };
+  };
+
+  config = {
+    environment.etc."sudoers.d/wheel-no-password" = mkIf (!config.security.sudo.wheelNeedsPassword) {
+      text = ''
+        %wheel ALL=(ALL) NOPASSWD: ALL
+      '';
+      # mode = "0440";
+    };
+  };
+}