diff --git a/roles/wheel/tasks/main.yml b/roles/wheel/tasks/main.yml
index e7af76a..6948dfc 100644
--- a/roles/wheel/tasks/main.yml
+++ b/roles/wheel/tasks/main.yml
@@ -6,3 +6,7 @@
 - name: 'alpine-specific wheel things'
   include_tasks: alpine.yml
   when: ansible_distribution == "Alpine"
+
+- name: setup with sudo
+  include_tasks: sudo.yml
+  when: ansible_distribution in ["Debian", "Ubuntu"]
diff --git a/roles/wheel/tasks/sudo.yml b/roles/wheel/tasks/sudo.yml
new file mode 100644
index 0000000..efe4792
--- /dev/null
+++ b/roles/wheel/tasks/sudo.yml
@@ -0,0 +1,11 @@
+- name: install sudo
+  apt:
+    name: sudo
+  when: ansible_distribution in ["Debian", "Ubuntu"]
+
+- name: allow wheel sudo without password
+  community.general.sudoers:
+    commands: ALL
+    group: wheel
+    name: wheel
+    nopassword: true