diff --git a/ansible/roles/ssh-ca/tasks/main.yml b/ansible/roles/ssh-ca/tasks/main.yml
index b20e1556..6b9f68df 100644
--- a/ansible/roles/ssh-ca/tasks/main.yml
+++ b/ansible/roles/ssh-ca/tasks/main.yml
@@ -143,6 +143,12 @@
     group: root
     mode: "0644"
 
+- name: Install sudo
+  ansible.builtin.package:
+    name: sudo
+    state: present
+  when: not ssh_ca_synouser.stat.exists
+
 - name: Install the Claude sudo rules
   ansible.builtin.template:
     src: sudoers-claude.j2
diff --git a/images/edge-host-iso/airootfs/usr/local/bin/edge-install b/images/edge-host-iso/airootfs/usr/local/bin/edge-install
index 51debb6e..c0c48467 100755
--- a/images/edge-host-iso/airootfs/usr/local/bin/edge-install
+++ b/images/edge-host-iso/airootfs/usr/local/bin/edge-install
@@ -57,7 +57,7 @@ mount --mkdir "$(part 1)" /mnt/boot
 
 # Everything the edge-host ansible role expects to find; the role itself
 # is applied over SSH after first boot (see ansible/docs/edge-host.md).
-pacstrap -K /mnt base linux linux-firmware intel-ucode openssh python git \
+pacstrap -K /mnt base linux linux-firmware intel-ucode openssh sudo python git \
   docker docker-compose
 
 genfstab -U /mnt >> /mnt/etc/fstab