diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix
index 7b6800e..af9612c 100644
--- a/modules/ipa/client.nix
+++ b/modules/ipa/client.nix
@@ -140,6 +140,7 @@ lib.mkIf enabled {
   users.users.${vars.ipaUser} = {
     isNormalUser = true;
     group = "users";
+    extraGroups = [ "wheel" ];
     createHome = false;
   };