diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix
index af9612c..88f7fea 100644
--- a/modules/ipa/client.nix
+++ b/modules/ipa/client.nix
@@ -137,6 +137,15 @@ lib.mkIf enabled {
   # With security.ipa setting "passwd: sss files" in nsswitch, SSSD's IPA entry
   # takes priority for NSS lookups — this local stub is only a fallback when
   # SSSD is unreachable (at which point auth fails anyway).
+  # HM with useUserPackages = true (flake.nix) sets users.users.${ipaUser}.packages,
+  # which forces the stub into /etc/passwd. pam_sss.so with the "localusers" flag
+  # (added by NixOS when SSSD is enabled) then skips SSSD for any user it finds in
+  # local /etc/passwd — including this stub — falling through to pam_unix, which has
+  # no password for the stub → sudo auth always fails.
+  #
+  # Fix: NOPASSWD for the IPA user. The IPA user already authenticated to reach a
+  # shell (SSH public key from IPA or Kerberos), so re-prompting via a broken PAM
+  # path is security theater on a single-admin homelab.
   users.users.${vars.ipaUser} = {
     isNormalUser = true;
     group = "users";
@@ -144,6 +153,11 @@ lib.mkIf enabled {
     createHome = false;
   };
 
+  security.sudo.extraRules = [{
+    users = [ vars.ipaUser ];
+    commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
+  }];
+
   # Home Manager config for the IPA primary user, applied on every enrolled
   # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session
   # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix)