diff --git a/arch.sh b/arch.sh
index 06ca92d..bf0f0c9 100755
--- a/arch.sh
+++ b/arch.sh
@@ -3,9 +3,8 @@ revision=1.0l
 set -a
 set -E
 
-# ZFS key
-# zfsgpgkey=DDF7DB817396A49B2A2723F7403BD972F75D9D76 # archzfs
-zfsgpgkey=D0F2AE55C1BF11A026D155813A658A95B8CFCC51 # myvezfs
+# myvezfs gpg key
+zfsgpgkey=D0F2AE55C1BF11A026D155813A658A95B8CFCC51
 
 # Exit function
 trap '[ "${?}" -ne 77 ] || exit 77' ERR
@@ -203,7 +202,7 @@ function repeat
 # Pacstrap new root and generate fs tables
 function pacstrapGenfstab
 {
-	local archpkgs="sudo openssh efibootmgr pacman-contrib \
+	local archpkgs="sudo-rs openssh efibootmgr pacman-contrib \
 		vim rsync pv git less openbsd-netcat \
 		man-db bash-completion reflector \
 		wireguard-tools systemd-resolvconf \
@@ -572,7 +571,7 @@ function generateKeyfile
 {
 	echo
 	say as heading 'Generating keyfile'
-	dd bs=1 count=256 if=/dev/random of=/mnt/crypto_keyfile.bin status=progress
+	dd bs=1 count=256 if=/dev/urandom of=/mnt/crypto_keyfile.bin status=progress
 	chmod 000 /mnt/crypto_keyfile.bin
 	printf '%s' "${grubpass}" | cryptsetup luksAddKey ${bootpart} /mnt/crypto_keyfile.bin
 
diff --git a/functions/chroot b/functions/chroot
index ac4a272..c7ac59d 100755
--- a/functions/chroot
+++ b/functions/chroot
@@ -170,33 +170,44 @@ unset userpass userpass2
 # Disable root account
 passwd -l root >/dev/null 2>&1
 
-# Sudoers
-install -m 0440 /dev/stdin /etc/sudoers.d/01-DEFAULTS <<- DEFAULTS
-Defaults passwd_timeout=0
-Defaults timestamp_type=global
-Defaults insults
+# sudo-rs sudoers
+# install -m 0440 /dev/stdin /etc/sudoers.d/01-DEFAULTS <<- DEFAULTS
+# Defaults passwd_timeout=0
+# Defaults timestamp_type=global
+# Defaults insults
+# DEFAULTS
+# install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- COMMANDS
+# Cmnd_Alias POWER    =   /usr/bin/poweroff, /usr/bin/reboot
+# Cmnd_Alias ZFS      =   /usr/bin/zfs, /usr/bin/zpool
+# Cmnd_Alias BTRFS    =   /usr/bin/btrfs, /usr/bin/timeshift, /usr/bin/timeshift-gtk, /usr/bin/timeshift-launcher
+# Cmnd_Alias QEMU     =   /usr/bin/virsh, /usr/bin/qemu-system-x86_64, /usr/bin/virt-install
+# Cmnd_Alias FAIL2BAN =   /usr/bin/fail2ban-client
+# Cmnd_Alias ARCHISO  =   /opt/local/bin/mkairgap, /opt/local/bin/mkiso
+# Cmnd_Alias PACMAN   =   /usr/bin/pacman -Sy
+# Cmnd_Alias IPTABLES =   /usr/bin/iptables, /usr/bin/iptables-save
+# Cmnd_Alias MISC     =   /usr/bin/rsync
+# COMMANDS
+# install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- WHEEL
+# %wheel ALL=(ALL:ALL) ALL
+# %wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, BTRFS, QEMU, FAIL2BAN, ARCHISO, PACMAN, IPTABLES, MISC
+# WHEEL
+# install -m 0440 /dev/stdin /etc/sudoers.d/.zz-NOPASSWD <<- NOPASSWD
+# Defaults:${username} !authenticate
+# NOPASSWD
+cat >/etc/pam.d/sudo <<- 'sudo'
+#%PAM-1.0
+auth		include		system-auth
+account		include		system-auth
+session		include		system-auth
+sudo
+ln -s -f /etc/pam.d/sudo /etc/pam.d/sudo-i
+install -m 0440 /dev/stdin /etc/sudoers-rs <<- 'DEFAULTS'
+Defaults!/usr/bin/visudo env_keep += "SUDO_EDITOR EDITOR VISUAL"
+Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/bin"
+root ALL=(ALL:ALL) ALL
+%wheel ALL=(ALL:ALL) NOPASSWD: ALL
 DEFAULTS
-
-install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- COMMANDS
-Cmnd_Alias POWER    =   /usr/bin/poweroff, /usr/bin/reboot
-Cmnd_Alias ZFS      =   /usr/bin/zfs, /usr/bin/zpool
-Cmnd_Alias BTRFS    =   /usr/bin/btrfs, /usr/bin/timeshift, /usr/bin/timeshift-gtk, /usr/bin/timeshift-launcher
-Cmnd_Alias QEMU     =   /usr/bin/virsh, /usr/bin/qemu-system-x86_64, /usr/bin/virt-install
-Cmnd_Alias FAIL2BAN =   /usr/bin/fail2ban-client
-Cmnd_Alias ARCHISO  =   /opt/local/bin/mkairgap, /opt/local/bin/mkiso
-Cmnd_Alias PACMAN   =   /usr/bin/pacman -Sy
-Cmnd_Alias IPTABLES =   /usr/bin/iptables, /usr/bin/iptables-save
-Cmnd_Alias MISC     =   /usr/bin/rsync
-COMMANDS
-
-install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- WHEEL
-%wheel ALL=(ALL:ALL) ALL
-%wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, BTRFS, QEMU, FAIL2BAN, ARCHISO, PACMAN, IPTABLES, MISC
-WHEEL
-
-install -m 0440 /dev/stdin /etc/sudoers.d/.zz-NOPASSWD <<- NOPASSWD
-Defaults:${username} !authenticate
-NOPASSWD
+ln -s -f /usr/bin/sudo-rs /usr/local/bin/sudo
 
 case ${filesystem} in
 	zfs)