diff --git a/docker/agent.Dockerfile b/docker/agent.Dockerfile
index 359fd8d9..fa7dfdd9 100644
--- a/docker/agent.Dockerfile
+++ b/docker/agent.Dockerfile
@@ -18,7 +18,6 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       git \
       libsecret-1-0 \
-      sudo \
       tmux \
       ripgrep \
       curl \
@@ -245,8 +244,6 @@ ENV HOME=/home/agent
 # Codeman's own host-side history/resume reads), and neither kind of artifact
 # creates its own parent directory.
 RUN useradd -g 0 -m -d /home/agent -s /bin/bash agent \
- && echo 'agent ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/agent \
- && chmod 0440 /etc/sudoers.d/agent \
  && mkdir -p /home/agent/.npm /home/agent/.cache /home/agent/.config /home/agent/.codeman \
       /home/agent/.claude/projects /home/agent/.codex/sessions /home/agent/.pi/agent /home/agent/.grok \
       /home/agent/.dsh /home/agent/.omp/agent \