# Permit only the fixed-path helper that atomically installs the pending
# RepoGoon config and restarts repogoon.service when it is already active.
repogoon ALL=(root) NOPASSWD: /usr/libexec/rgoon-sync-apply-repogoon-config
