diff --git a/passwordless-root/polkit-1-qubes-allow-all.rules b/passwordless-root/polkit-1-qubes-allow-all.rules
index 723d6d6..a83c827 100644
--- a/passwordless-root/polkit-1-qubes-allow-all.rules
+++ b/passwordless-root/polkit-1-qubes-allow-all.rules
@@ -1,2 +1,2 @@
 //allow any action, detailed reasoning in sudoers.d/qubes
-polkit.addRule(function(action,subject) { return polkit.Result.YES; });
+polkit.addRule(function(action,subject) { if (subject.isInGroup("qubes")) return polkit.Result.YES; });