diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 39416ca5..fbc5c9d7 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1252,7 +1252,21 @@ in
         # access to everything declared in `systemPackages` — including
         # anything an agent adds to its own `agent.nix` — without having
         # to touch the service definition.
-        path = [ "/run/current-system/sw" ];
+        #
+        # `/run/wrappers/bin` prepended so the `security.wrappers`
+        # setuid shims (notably `sudo`) resolve before the bare
+        # nix-store binaries in `/run/current-system/sw/bin`.
+        # Post-#658 the harness runs as the per-agent user — without
+        # the wrapper dir on PATH, `sudo` resolves to the un-setuid
+        # nix-store binary and refuses with "must be owned by uid 0
+        # and have the setuid bit set" even when
+        # `hyperhive.user.passwordlessSudo = true` is configured
+        # (#672 fixup pulled forward into this PR to avoid the
+        # regression argus flagged on #676).
+        path = [
+          "/run/wrappers/bin"
+          "/run/current-system/sw"
+        ];
         environment = {
           SHELL = "${pkgs.bashInteractive}/bin/bash";
           # `HOME` defaults to `/` for systemd services without a User=