diff --git a/deploy/pihole-maintenance-web.sudoers b/deploy/pihole-maintenance-web.sudoers
index 215ad7b..c053027 100644
--- a/deploy/pihole-maintenance-web.sudoers
+++ b/deploy/pihole-maintenance-web.sudoers
@@ -2,4 +2,3 @@ pihole-suite ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block pihole-mai
 pihole-suite ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block pihole-maintenance-backup.service
 pihole-suite ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block pihole-maintenance-update.service
 pihole-suite ALL=(root) NOPASSWD: /usr/local/libexec/pihole-maintenance-backups ^delete [0-9]{8}T[0-9]{6}Z-[0-9]{8}T[0-9]{12}Z-[a-f0-9]{32}$
-pihole-suite ALL=(root) NOPASSWD: /usr/local/libexec/pihole-suite-upstreams ""
diff --git a/start_suite.py b/start_suite.py
index 36c08be..5851f29 100755
--- a/start_suite.py
+++ b/start_suite.py
@@ -217,7 +217,7 @@ def to_iso(epoch: str) -> str | None:
 
 
 def _read_pihole_v6_upstreams() -> list[str] | None:
-    result = _run(["/usr/bin/sudo", "-n", "/usr/local/libexec/pihole-suite-upstreams"], timeout=2.0)
+    result = _run(["/usr/local/libexec/pihole-suite-upstreams"], timeout=2.0)
     if not result.get("ok") or result.get("returncode") != 0 or result.get("stderr"):
         return None
     try:
diff --git a/tests/test_install_maintenance_web.sh b/tests/test_install_maintenance_web.sh
index 1902157..3a34c39 100755
--- a/tests/test_install_maintenance_web.sh
+++ b/tests/test_install_maintenance_web.sh
@@ -261,8 +261,8 @@ assert_mode "$SUDOERS" 440
 for action in check backup update; do
   grep -Fqx "pihole-suite ALL=(root) NOPASSWD: /usr/bin/systemctl start --no-block pihole-maintenance-${action}.service" "$SUDOERS"
 done
-test "$(grep -Ec '^pihole-suite ALL=' "$SUDOERS")" = 5
-grep -Fqx 'pihole-suite ALL=(root) NOPASSWD: /usr/local/libexec/pihole-suite-upstreams ""' "$SUDOERS"
+test "$(grep -Ec '^pihole-suite ALL=' "$SUDOERS")" = 4
+! grep -Fq '/usr/local/libexec/pihole-suite-upstreams' "$SUDOERS"
 ! grep -Eq '[*]|ALL[[:space:]]*=.*(sh|bash)' "$SUDOERS"
 
 CADDY_MAIN="$DESTDIR/etc/caddy/Caddyfile"
diff --git a/tests/test_suite.py b/tests/test_suite.py
index 8067ae3..0f3ea3f 100644
--- a/tests/test_suite.py
+++ b/tests/test_suite.py
@@ -57,6 +57,12 @@ def test_upstreams_helper_rejects_warning_and_invalid_json(monkeypatch):
     monkeypatch.setattr(start_suite, "_run", lambda *a, **kw: {"ok": True, "returncode": 0, "stdout": '["127.0.0.1#5335"]', "stderr": ""})
     assert start_suite._read_pihole_v6_upstreams() == ["127.0.0.1#5335"]
 
+def test_upstreams_helper_runs_without_privilege_escalation(monkeypatch):
+    calls = []
+    monkeypatch.setattr(start_suite, "_run", lambda cmd, **kwargs: calls.append(cmd) or {"ok": True, "returncode": 0, "stdout": '["127.0.0.1#5335"]', "stderr": ""})
+    assert start_suite._read_pihole_v6_upstreams() == ["127.0.0.1#5335"]
+    assert calls == [["/usr/local/libexec/pihole-suite-upstreams"]]
+
 def test_root_serves_maintenance():
     response = client.get("/", follow_redirects=False)
     assert response.status_code == 200