diff --git a/devdoc/darwin.md b/devdoc/darwin.md
index 090e1ac..f040f7d 100644
--- a/devdoc/darwin.md
+++ b/devdoc/darwin.md
@@ -104,7 +104,7 @@ curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix
 ### Install nix-darwin
 
 ```sh
-nix --extra-experimental-features 'flakes nix-command' --option accept-flake-config true \
+sudo -H nix --extra-experimental-features 'flakes nix-command' --option accept-flake-config true \
   run 'github:LnL7/nix-darwin#darwin-rebuild' -- switch --option accept-flake-config true --flake 'github:nix-community/infra#$HOSTNAME'
 ```
 
diff --git a/tasks.py b/tasks.py
index bba4314..af9506e 100644
--- a/tasks.py
+++ b/tasks.py
@@ -23,8 +23,7 @@ def deploy(c: Any, hosts: str) -> None:
 
     def deploy(h: DeployHost) -> None:
         if "darwin" in h.host:
-            # don't use sudo for darwin-rebuild
-            command = "darwin-rebuild"
+            command = "sudo -H darwin-rebuild"
             target = f"{h.user}@{h.host}"
         else:
             command = "sudo nixos-rebuild"