diff --git a/scripts/deploy b/scripts/deploy
index 21dfa92..d891b27 100755
--- a/scripts/deploy
+++ b/scripts/deploy
@@ -91,10 +91,14 @@ case "$cmd" in
     { [ -n "$config" ] && [ -n "$host" ]; } || die "usage: ./deploy $cmd <config> <host>"
 
     echo ">> nixos-rebuild $cmd .#$config on darman@$host"
+    # --ask-sudo-password, not the deprecated --use-remote-sudo: common.nix sets
+    # security.sudo.wheelNeedsPassword = true, and --use-remote-sudo only
+    # prefixes with sudo without ever prompting. Asks for darman's password
+    # (the darman_password hash in each host's sops file).
     nix run nixpkgs#nixos-rebuild -- "$cmd" \
       --flake ".#$config" \
       --target-host "darman@$host" \
-      --use-remote-sudo
+      --ask-sudo-password
     ;;
 
   image|flash)