diff --git a/hosts/common/global/openssh.nix b/hosts/common/global/openssh.nix
index fcdea46a..fb58a5ee 100644
--- a/hosts/common/global/openssh.nix
+++ b/hosts/common/global/openssh.nix
@@ -2,7 +2,6 @@
   outputs,
   lib,
   config,
-  pkgs,
   ...
 }: let
   hosts = lib.attrNames outputs.nixosConfigurations;
@@ -55,20 +54,8 @@ in {
   };
 
   # Passwordless sudo when SSH'ing with keys
-  security.pam.services.sudo = {config, ...}: {
-    rules.auth.rssh = {
-      order = config.rules.auth.ssh_agent_auth.order - 1;
-      control = "sufficient";
-      modulePath = "${pkgs.pam_rssh}/lib/libpam_rssh.so";
-      settings.authorized_keys_command =
-        pkgs.writeShellScript "get-authorized-keys"
-        ''
-          cat "/etc/ssh/authorized_keys.d/$1"
-        '';
-    };
+  security.pam.sshAgentAuth = {
+    enable = true;
+    authorizedKeysFiles = ["/etc/ssh/authorized_keys.d/%u"];
   };
-  # Keep SSH_AUTH_SOCK when sudo'ing
-  security.sudo.extraConfig = ''
-    Defaults env_keep+=SSH_AUTH_SOCK
-  '';
 }