{ pkgs, ... }:
let
  sudoLocal = pkgs.writeText "sudo_local" ''
    # Managed by nix-darwin: use Touch ID for sudo with password fallback.
    auth       sufficient     pam_tid.so
  '';
in
{
  system.activationScripts.postActivation.text = ''
    /usr/bin/install -m 0444 "${sudoLocal}" /etc/pam.d/sudo_local
  '';
}