diff --git a/flake.nix b/flake.nix
index c566e9b..df3c490 100644
--- a/flake.nix
+++ b/flake.nix
@@ -10,27 +10,32 @@
 
   outputs = { self, nixpkgs, nixos-hardware, ... }:
   let
-    # Authorization keys for user mappings (login keys per user)
-    auth_keys = {
-      alice = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALiceKeyPlaceholder alice@host"
-      ];
-      bob = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobKeyPlaceholder bob@host"
-      ];
+    # Per-user mapping of auth (login) and sudo keys
+    key_mappings = {
+      alice = {
+        auth = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceAuthKeyPlaceholder alice@host"
+        ];
+        sudo = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceSudoKeyPlaceholder alice-admin@host"
+        ];
+      };
+      bob = {
+        auth = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobAuthKeyPlaceholder bob@host"
+        ];
+        sudo = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobSudoKeyPlaceholder bob-admin@host"
+        ];
+      };
     };
 
-    # Sudo keys per user (keys granting sudo, applied to root)
-    sudo_keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAISudoKeyPlaceholder admin@host"
-    ];
-
     sharedModules = [
       ./modules/users.nix
     ];
 
     sharedArgs = {
-      inherit auth_keys sudo_keys;
+      inherit key_mappings;
     };
   in {
     nixosConfigurations = {
diff --git a/modules/users.nix b/modules/users.nix
index e818cd9..63dc340 100644
--- a/modules/users.nix
+++ b/modules/users.nix
@@ -1,6 +1,11 @@
-{ config, lib, pkgs, auth_keys, sudo_keys, ... }:
+{ config, lib, pkgs, key_mappings, ... }:
 
-{
+let
+  auth_keys = lib.mapAttrs (_: u: u.auth) key_mappings;
+  sudo_keys = lib.concatLists
+    (lib.attrValues
+      (lib.mapAttrs (_: u: u.sudo) key_mappings));
+in {
   users.users = {
     root.openssh.authorizedKeys.keys = sudo_keys;
   } // (lib.mapAttrs (name: keys: {