diff --git a/modules/monitoring.nix b/modules/monitoring.nix
index 4849ff4..a74af4d 100644
--- a/modules/monitoring.nix
+++ b/modules/monitoring.nix
@@ -23,7 +23,8 @@
     set -u
     for dev in /dev/sd?; do
       [ -b "$dev" ] || continue
-      out=$(${pkgs.sudo}/bin/sudo ${pkgs.smartmontools}/bin/smartctl -a "$dev" 2>/dev/null) || continue
+      # Use NixOS security wrapper sudo (the Nix store sudo lacks setuid bit)
+      out=$(/run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl -a "$dev" 2>/dev/null) || continue
 
       # Only SAS drives — skip if not SAS
       echo "$out" | ${pkgs.gnugrep}/bin/grep -q "Transport protocol:.*SAS" || continue