Omarchy goes back to one sudo password for ten minutes, backported to 4.5 for RC3
The strict per-command sudo boundary tested in the 4.5 release candidates is gone: type your password once and it carries over for ten minutes. The fix rides into 4.5 RC3 with eight other backports.
Image: omacom/omarchy #17000 (GitHub)
No more typing your password three times in a row. Pull request #17000, merged by DHH on October 31, 2026, returns Omarchy to ordinary sudo behavior: one password now covers ten minutes in the same terminal. The repeated prompts came from a security boundary that is new in 4.5, so people running the stable 4.0.6 release never saw them, and 4.5 testers get the fix soon: it is already backported for 4.5 RC3.
The PR spells out how bad the prompting had become. “A fresh install’s update asked three times at ‘Create system snapshot’, and a dev link session asked six times,” it says. “A password typed one command earlier never carried over to the next.”
The cause was the command-scoped sudo boundary introduced by two security fixes, OM-SEC-14 (#9469) and OM-SEC-22 (#10217). Omarchy commands cleared sudo’s cached timestamp with sudo -k when they started and exited, and ran privileged steps through a sudo -N wrapper that authenticates without caching. The goal was to keep code Omarchy runs as the user, such as hooks, AUR builds and mise installers, away from a warm sudo cache.
According to the PR, that protection didn’t buy much. Code running as the user “already has easier routes to root”: an AUR package’s install scripts and pacman hooks run as root by design, and anything running as the user can put its own sudo on the PATH and wait for the next password. “Every major distribution caches sudo for the same reason,” the PR notes.
So the new etc/sudoers.d/omarchy-sudo-timeout file sets timestamp_timeout=10, and no Omarchy command clears the cache or goes through sudo -N anymore. omarchy-update, omarchy-refresh-pacman and omarchy-channel-set are plain Bash scripts again, as in 4.0.6, while features added since then stay, including the boot check, the free-space check and the update lock. omarchy update still asks for your password once up front, with a keepalive so long downloads never outlast the authorization.
Two fixes that guard against other accounts on the machine stay in place. omarchy-update-stay-awake (OM-SEC-12) keeps its checks so another account can’t make update cleanup kill an arbitrary process, and omarchy-sudo-passwordless (OM-SEC-01) keeps its grant validation and fail-closed expiry.
The change is headed to 4.5 through pull request #17220, “Backport nine quattro fixes to 4.5 for RC3”, which Ryan Hughes merged into the v4-5-0 branch on November 1, 2026. He calls #17000 “the big one”: it accounts for most of the code removed by the backport. The other fixes coming in 4.5 RC3:
- Omasnap’s scroll capture no longer records black frames
- Installing T3 Code no longer fails on a race with its mounter
- You can type to search the installer’s timezone picker again after it guesses a timezone
- HDR monitors no longer switch into HDR on fullscreen and wash out SDR content
- Hyprland’s donation popup stops appearing after upgrades
- Apple Silicon gets an RC pacman config, so Macs can follow the RC channel
- Apple Silicon accounts now load Omarchy’s
.bashrcinstead of Arch’s stock one, without overwriting an earlier~/.bashrc.bak
RC3 isn’t tagged yet: the latest 4.5 prerelease on GitHub is still RC2. When RC3 lands, an update should ask for your password just once.
