diff --git a/setup b/setup
index df939ed..bc2ba7f 100755
--- a/setup
+++ b/setup
@@ -177,11 +177,35 @@ install_pscripts() {
     done
 }
 
-enable_sudo_without_password() {
-    if ! sudo grep -q NOPASSWD /etc/sudoers; then
-        : Allow sudo without password
-        sudo sed -E -i.bak 's|^(%sudo.+ALL:ALL\)) (ALL)|\1 NOPASSWD:SETENV: \2|' /etc/sudoers
+_install_sudoers_snippet() {
+    : "_install_sudoers_snippet <name> <line>... -- validates before installing"
+    local name=$1 tmp
+    shift
+
+    if ! sudo grep -qE '^[@#]includedir[[:space:]]+/etc/sudoers.d' /etc/sudoers; then
+        die "/etc/sudoers does not include /etc/sudoers.d; refusing to edit sudoers"
+    fi
+
+    tmp=$(mktemp)
+    printf '%s\n' "$@" >"$tmp"
+
+    # Never install a sudoers file we have not parsed: a syntax error in
+    # /etc/sudoers.d locks the machine out of sudo entirely.
+    if ! sudo visudo -cf "$tmp" >/dev/null; then
+        rm -f "$tmp"
+        die "generated sudoers snippet '$name' is invalid; not installing"
     fi
+
+    sudo install -o root -g root -m 0440 "$tmp" "/etc/sudoers.d/$name"
+    rm -f "$tmp"
+}
+
+enable_sudo_without_password() {
+    : Allow sudo without password
+    # SETENV is required for the "sudo -E" calls elsewhere in this script
+    _install_sudoers_snippet prestobuntu-nopasswd \
+        '# Managed by prestobuntu' \
+        '%sudo ALL=(ALL:ALL) NOPASSWD:SETENV: ALL'
 }
 
 remove_sudo_warning() {
@@ -189,7 +213,9 @@ remove_sudo_warning() {
 }
 
 pass_http_thru_sudo() {
-    _require_line 'Defaults:%sudo env_keep += "http_proxy https_proxy"' /etc/sudoers
+    _install_sudoers_snippet prestobuntu-proxy \
+        '# Managed by prestobuntu' \
+        'Defaults:%sudo env_keep += "http_proxy https_proxy"'
 }
 
 setup_ssh() {