diff --git a/run_once_20-install-user-packages.sh.tmpl b/run_once_20-install-user-packages.sh.tmpl
index 0c6f121..8f1d0a0 100755
--- a/run_once_20-install-user-packages.sh.tmpl
+++ b/run_once_20-install-user-packages.sh.tmpl
@@ -162,7 +162,11 @@ if fc-list 2>/dev/null | grep -qi "Maple Mono NF"; then
 else
 {{ if eq .os_family "arch" -}}
     log "installing maplemono-nf-cn from AUR (via paru)"
-    paru -S --needed --noconfirm maplemono-nf-cn
+    # paru refuses to run as root, so don't sudo it. --sudoloop runs sudo
+    # in the background so any internal sudo prompts don't block the
+    # non-interactive chezmoi run. If the host doesn't have NOPASSWD sudo,
+    # paru will fail (and the bootstrap will surface the error).
+    paru --sudoloop -S --needed --noconfirm maplemono-nf-cn
 {{ else if eq .os_family "debian" -}}
     log "downloading MapleMono-NF.zip from subframe7536/Maple-font $MAPLE_FONT_VERSION"
     FONT_DIR="$USER_HOME/.local/share/fonts/maple-mono-nf"