{ lib, ... }: { security.sudo.wheelNeedsPassword = lib.mkDefault false; users.groups.guests = {}; }