diff --git a/internal/proxmox/bootstrap.go b/internal/proxmox/bootstrap.go
index f9f5bfa..c564fe6 100644
--- a/internal/proxmox/bootstrap.go
+++ b/internal/proxmox/bootstrap.go
@@ -449,8 +449,8 @@ func sudoersContent(user string) string {
 # pvesh is EXCLUDED (AD-020: pvesh can bypass NOEXEC via API execute).
 %s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct
 %s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/qm
-%s ALL=(root) NOPASSWD: /usr/bin/apt-get
-%s ALL=(root) NOPASSWD: /usr/bin/dpkg
+%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/apt-get
+%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/dpkg
 `, user, user, user, user)
 }