{
  pkgs,
  config,
  ...
}: {
  security.sudo = {
    enable = true;
    extraRules = [{
      commands = [
        {
          command = "${pkgs.systemd}/bin/systemctl poweroff";
          options = [ "NOPASSWD" ];
        }
        {
          command = "${pkgs.systemd}/bin/shutdown";
          options = [ "NOPASSWD" ];
        }
        {
          command = "${pkgs.systemd}/bin/systemctl reboot";
          options = [ "NOPASSWD" ];
        }
        {
          command = "${pkgs.systemd}/bin/reboot";
          options = [ "NOPASSWD" ];
        }
        {
          command = "${pkgs.efibootmgr}/bin/efibootmgr";
          options = [ "NOPASSWD" ];
        }
        {
          command = "${pkgs.efibootmgr}/bin/efibootdump";
          options = [ "NOPASSWD" ];
        }
      ];
      users = [ "grey" ];
    }];
    extraConfig = with pkgs; ''
      Defaults:grey secure_path="${lib.makeBinPath [
        systemd
      ]}:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"
    '';
  };
}