diff --git a/arch-config/etc/sudoers.d/wireguard b/arch-config/etc/sudoers.d/wireguard
new file mode 100644
index 00000000..33f45157
--- /dev/null
+++ b/arch-config/etc/sudoers.d/wireguard
@@ -0,0 +1,3 @@
+# The "wg show all" command may be run by anyone in the group "wireguard"
+
+%wireguard ALL=(ALL) NOPASSWD: /usr/bin/wg show interfaces