diff --git a/hosts/neodymium/configuration.nix b/hosts/neodymium/configuration.nix
index c218105..a6392ec 100644
--- a/hosts/neodymium/configuration.nix
+++ b/hosts/neodymium/configuration.nix
@@ -26,6 +26,9 @@ in {
   # clean /tmp at each boot
   boot.cleanTmpDir = true;
 
+  # restrict nix command to sudoers
+  nix.allowedUsers = [ "@wheel" ];
+
   # hardware
   hardware = {
     enableRedistributableFirmware = true;