diff --git a/bin/omarchy-cmd-first-run b/bin/omarchy-cmd-first-run
index af1a7632..573503fe 100755
--- a/bin/omarchy-cmd-first-run
+++ b/bin/omarchy-cmd-first-run
@@ -8,5 +8,5 @@ if [[ -f FIRST_RUN_MODE ]]; then
   $OMARCHY_PATH/install/first-run/battery-monitor.sh
   $OMARCHY_PATH/install/first-run/firewall.sh
   rm FIRST_RUN_MODE
-  sudo rm -f /etc/sudoers.d/99-omarchy-installer &>/dev/null
+  sudo rm -f /etc/sudoers.d/first-run &>/dev/null
 fi
diff --git a/install.sh b/install.sh
index edf288c4..426ef3de 100755
--- a/install.sh
+++ b/install.sh
@@ -71,6 +71,7 @@ omarchy-show-logo
 echo -e "\n\e[32mYou're done! So we're ready to reboot now...\e[0m"
 
 if sudo test -f /etc/sudoers.d/99-omarchy-installer; then
+  sudo rm -f /etc/sudoers.d/99-omarchy-installer &>/dev/null
   echo -e "\nRemember to remove USB installer!"
 fi
 
diff --git a/install/preflight/first-run-mode.sh b/install/preflight/first-run-mode.sh
index be882225..e1ae129c 100755
--- a/install/preflight/first-run-mode.sh
+++ b/install/preflight/first-run-mode.sh
@@ -3,3 +3,11 @@
 # Set first-run mode marker so we can install stuff post-installation
 mkdir -p ~/.local/state/omarchy
 touch ~/.local/state/omarchy/first-run.mode
+
+# Setup sudo-less access for first-run
+sudo tee /etc/sudoers.d/first-run >/dev/null <<EOF
+$USER ALL=(ALL) NOPASSWD: /usr/bin/ufw
+$USER ALL=(ALL) NOPASSWD: /usr/bin/ufw-docker
+$USER ALL=(ALL) NOPASSWD: /bin/rm -f /etc/sudoers.d/first-run
+EOF
+sudo chmod 440 /etc/sudoers.d/first-run