diff --git a/base.nix b/base.nix
index 092cce2..27b8522 100644
--- a/base.nix
+++ b/base.nix
@@ -80,6 +80,9 @@
     enable = true;
     extraConfig = ''
       PubkeyAcceptedAlgorithms=+ssh-rsa
+      Match Group wheel
+        PasswordAuthentication no
+      Match All
     '';
     settings.PermitRootLogin = "yes";
   };