diff --git a/passwordless-root/polkit-1-qubes-allow-all.pkla b/passwordless-root/polkit-1-qubes-allow-all.pkla
index 1ff7ded..20e9c7f 100644
--- a/passwordless-root/polkit-1-qubes-allow-all.pkla
+++ b/passwordless-root/polkit-1-qubes-allow-all.pkla
@@ -1,5 +1,5 @@
 [Qubes allow all]
-Identity=*
+Identity=unix-group:qubes
 Action=*
 ResultAny=yes
 ResultInactive=yes