diff --git a/run_once_00-install-bootstrap-tools.sh.tmpl b/run_once_00-install-bootstrap-tools.sh.tmpl
index 3d7f0fa..16bd91e 100755
--- a/run_once_00-install-bootstrap-tools.sh.tmpl
+++ b/run_once_00-install-bootstrap-tools.sh.tmpl
@@ -15,22 +15,22 @@ die() { printf '\033[1;31m[bootstrap ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
 
 {{ if eq .os_family "arch" -}}
 log "pacman-sync"
-pacman -Sy --noconfirm
+sudo pacman -Sy --noconfirm
 
 log "install base tools (arch)"
 PACMAN_PKGS=(age curl ca-certificates git base-devel wget)
-pacman -S --needed --noconfirm "${PACMAN_PKGS[@]}"
+sudo pacman -S --needed --noconfirm "${PACMAN_PKGS[@]}"
 
 {{ else if eq .os_family "debian" -}}
 export DEBIAN_FRONTEND=noninteractive
 log "apt-update"
-apt-get update -y
+sudo apt-get update -y
 log "apt-upgrade"
-apt-get upgrade -y
+sudo apt-get upgrade -y
 
 log "install base tools (debian)"
 APT_PKGS=(age curl ca-certificates git wget gnupg)
-apt-get install -y --no-install-recommends "${APT_PKGS[@]}"
+sudo apt-get install -y --no-install-recommends "${APT_PKGS[@]}"
 
 {{ else -}}
 die "unsupported os_family: {{ .os_family }} (this script supports arch or debian)"