diff --git a/nix-os/polkit/network.nix b/nix-os/polkit/network.nix
index 76d559f..632cacf 100644
--- a/nix-os/polkit/network.nix
+++ b/nix-os/polkit/network.nix
@@ -5,6 +5,7 @@
         // Allow to start and stop wireguard client services
         if (
           action.id == "org.freedesktop.systemd1.manage-units" &&
+          subject.isInGroup("users") &&
           action.lookup("unit") &&
           action.lookup("unit").match(/^wg-quick-.*\.service$/)
         ) {