{
  security.polkit.extraConfig = /*javascript*/ ''
    polkit.addRule(function(action, subject) {
      if (
        action.id == "org.freedesktop.policykit.exec" &&
        subject.isInGroup("wheel")
      ) {
        if (subject.active) {
          return polkit.Result.AUTH_SELF_KEEP;
        } else {
          return polkit.Result.AUTH_SELF;
        }
      }
    });
  '';
}