diff --git a/install/config/fix-powerprofilesctl-shebang.sh b/install/config/fix-powerprofilesctl-shebang.sh
index db2a9bd7..60b8509b 100644
--- a/install/config/fix-powerprofilesctl-shebang.sh
+++ b/install/config/fix-powerprofilesctl-shebang.sh
@@ -1,4 +1,4 @@
 # Ensure we use system python3 and not mise's python3
 if [[ -f /usr/bin/powerprofilesctl ]]; then
-  sed -i '/env python3/ c\#!/bin/python3' /usr/bin/powerprofilesctl
+  sudo sed -i '/env python3/ c\#!/bin/python3' /usr/bin/powerprofilesctl
 fi
diff --git a/install/config/hardware/apple/fix-spi-keyboard.sh b/install/config/hardware/apple/fix-spi-keyboard.sh
index 29d359d8..330081b7 100644
--- a/install/config/hardware/apple/fix-spi-keyboard.sh
+++ b/install/config/hardware/apple/fix-spi-keyboard.sh
@@ -4,12 +4,12 @@ if [[ $product_name =~ MacBook[89],1|MacBook1[02],1|MacBookPro13,[123]|MacBookPr
   echo "Detected MacBook with SPI keyboard"
 
   omarchy-pkg-add macbook12-spi-driver-dkms
-  mkdir -p /etc/mkinitcpio.conf.d
+  sudo mkdir -p /etc/mkinitcpio.conf.d
   if [[ $product_name == "MacBook8,1" ]]; then
-    echo "MODULES=(applespi spi_pxa2xx_platform spi_pxa2xx_pci)" > \
-      /etc/mkinitcpio.conf.d/macbook_spi_modules.conf
+    echo "MODULES=(applespi spi_pxa2xx_platform spi_pxa2xx_pci)" | \
+      sudo tee /etc/mkinitcpio.conf.d/macbook_spi_modules.conf >/dev/null
   else
-    echo "MODULES=(applespi intel_lpss_pci spi_pxa2xx_platform)" > \
-      /etc/mkinitcpio.conf.d/macbook_spi_modules.conf
+    echo "MODULES=(applespi intel_lpss_pci spi_pxa2xx_platform)" | \
+      sudo tee /etc/mkinitcpio.conf.d/macbook_spi_modules.conf >/dev/null
   fi
 fi
diff --git a/install/config/hardware/apple/fix-suspend-nvme.sh b/install/config/hardware/apple/fix-suspend-nvme.sh
index d761bd01..27e0270e 100644
--- a/install/config/hardware/apple/fix-suspend-nvme.sh
+++ b/install/config/hardware/apple/fix-suspend-nvme.sh
@@ -10,8 +10,8 @@ if [[ $MACBOOK_MODEL =~ MacBook(8,1|9,1|10,1)|MacBookPro13,[123]|MacBookPro14,[1
   if [[ -f $NVME_DEVICE ]]; then
     echo "Applying NVMe suspend fix..."
 
-    mkdir -p /etc/systemd/system
-    cat > /etc/systemd/system/omarchy-nvme-suspend-fix.service <<'EOF'
+    sudo mkdir -p /etc/systemd/system
+    sudo tee /etc/systemd/system/omarchy-nvme-suspend-fix.service >/dev/null <<'EOF'
 [Unit]
 Description=Omarchy NVMe Suspend Fix for MacBook
 
@@ -22,7 +22,7 @@ ExecStart=/bin/bash -c 'echo 0 > /sys/bus/pci/devices/0000\:01\:00.0/d3cold_allo
 WantedBy=multi-user.target
 EOF
 
-    systemctl enable omarchy-nvme-suspend-fix.service
+    sudo systemctl enable omarchy-nvme-suspend-fix.service
   else
     echo "Warning: NVMe device not found at expected PCI address (0000:01:00.0)"
     echo "This fix may not be needed for this MacBook model"
diff --git a/install/config/hardware/asus/fix-asus-ptl-display-backlight.sh b/install/config/hardware/asus/fix-asus-ptl-display-backlight.sh
index 252a1c61..0ca01031 100644
--- a/install/config/hardware/asus/fix-asus-ptl-display-backlight.sh
+++ b/install/config/hardware/asus/fix-asus-ptl-display-backlight.sh
@@ -8,8 +8,8 @@
 # but produce no visible change; brightness is effectively binary.
 
 if omarchy-hw-asus-expertbook-b9406 || omarchy-hw-asus-zenbook-ux5406aa; then
-  mkdir -p /etc/limine-entry-tool.d
-  cat > /etc/limine-entry-tool.d/asus-ptl-display-backlight.conf <<'EOF'
+  sudo mkdir -p /etc/limine-entry-tool.d
+  sudo tee /etc/limine-entry-tool.d/asus-ptl-display-backlight.conf >/dev/null <<'EOF'
 # ASUS Panther Lake display backlight fix
 KERNEL_CMDLINE[default]+=" xe.enable_dpcd_backlight=1"
 EOF
diff --git a/install/config/hardware/asus/fix-z13-touchpad.sh b/install/config/hardware/asus/fix-z13-touchpad.sh
index 4db3970f..5a710f42 100644
--- a/install/config/hardware/asus/fix-z13-touchpad.sh
+++ b/install/config/hardware/asus/fix-z13-touchpad.sh
@@ -11,8 +11,8 @@
 # so dwt can properly pair it with the keyboard.
 
 if omarchy-hw-asus-rog && omarchy-hw-match "GZ302"; then
-  mkdir -p /etc/udev/rules.d
-  cat > /etc/udev/rules.d/99-omarchy-asus-z13-touchpad.rules <<'EOF'
+  sudo mkdir -p /etc/udev/rules.d
+  sudo tee /etc/udev/rules.d/99-omarchy-asus-z13-touchpad.rules >/dev/null <<'EOF'
 ACTION=="add|change", KERNEL=="event*", ATTRS{idVendor}=="0b05", ATTRS{idProduct}=="1a30", ENV{ID_INPUT_TOUCHPAD}=="1", ENV{ID_INPUT_TOUCHPAD_INTEGRATION}="internal"
 EOF
 fi
diff --git a/install/config/hardware/fix-fkeys.sh b/install/config/hardware/fix-fkeys.sh
index 73b107f9..ae7fee52 100644
--- a/install/config/hardware/fix-fkeys.sh
+++ b/install/config/hardware/fix-fkeys.sh
@@ -1,5 +1,5 @@
 # Ensure that F-keys on Apple-like keyboards (such as Lofree Flow84) are always F-keys
 if [[ ! -f /etc/modprobe.d/hid_apple.conf ]]; then
-  mkdir -p /etc/modprobe.d
-  echo "options hid_apple fnmode=2" > /etc/modprobe.d/hid_apple.conf
+  sudo mkdir -p /etc/modprobe.d
+  echo "options hid_apple fnmode=2" | sudo tee /etc/modprobe.d/hid_apple.conf >/dev/null
 fi
diff --git a/install/config/hardware/framework/qmk-hid.sh b/install/config/hardware/framework/qmk-hid.sh
index 8e0a67a8..19561332 100644
--- a/install/config/hardware/framework/qmk-hid.sh
+++ b/install/config/hardware/framework/qmk-hid.sh
@@ -1,8 +1,8 @@
 # Allow unprivileged access to the Framework 16 keyboard for RGB control via qmk_hid.
 
 if omarchy-hw-framework16; then
-  mkdir -p /etc/udev/rules.d
+  sudo mkdir -p /etc/udev/rules.d
   if [[ ! -f /etc/udev/rules.d/50-framework16-qmk-hid.rules ]]; then
-    cp -f "$OMARCHY_PATH/default/udev/framework16-qmk-hid.rules" /etc/udev/rules.d/50-framework16-qmk-hid.rules
+    sudo cp -f "$OMARCHY_PATH/default/udev/framework16-qmk-hid.rules" /etc/udev/rules.d/50-framework16-qmk-hid.rules
   fi
 fi
diff --git a/install/config/hardware/intel/fred.sh b/install/config/hardware/intel/fred.sh
index fcc4d3c2..b7e0d307 100644
--- a/install/config/hardware/intel/fred.sh
+++ b/install/config/hardware/intel/fred.sh
@@ -4,15 +4,15 @@ DROP_IN="/etc/limine-entry-tool.d/intel-panther-lake-fred.conf"
 DEFAULT_LIMINE="/etc/default/limine"
 
 if omarchy-hw-intel-ptl; then
-  if [[ ! -f "$DROP_IN" ]] || ! grep -q 'fred=on' "$DROP_IN"; then
-    mkdir -p /etc/limine-entry-tool.d
-    cat > "$DROP_IN" <<EOF
+  if [[ ! -f $DROP_IN ]] || ! grep -q 'fred=on' "$DROP_IN"; then
+    sudo mkdir -p /etc/limine-entry-tool.d
+    cat <<EOF | sudo tee "$DROP_IN" >/dev/null
 # Intel Panther Lake FRED support
 KERNEL_CMDLINE[default]+=" fred=on"
 EOF
   fi
 
-  if [[ -f "$DEFAULT_LIMINE" ]] && ! grep -q 'fred=on' "$DEFAULT_LIMINE"; then
-    cat "$DROP_IN" >> "$DEFAULT_LIMINE"
+  if [[ -f $DEFAULT_LIMINE ]] && ! grep -q 'fred=on' "$DEFAULT_LIMINE"; then
+    cat "$DROP_IN" | sudo tee -a "$DEFAULT_LIMINE" >/dev/null
   fi
 fi
diff --git a/install/config/hardware/intel/lpmd.sh b/install/config/hardware/intel/lpmd.sh
index 0073593b..ad8cf374 100644
--- a/install/config/hardware/intel/lpmd.sh
+++ b/install/config/hardware/intel/lpmd.sh
@@ -6,6 +6,6 @@ if omarchy-hw-intel && omarchy-battery-present; then
   cpu_model=$(grep -m1 "^model\s*:" /proc/cpuinfo 2>/dev/null | cut -d: -f2 | tr -d ' ')
   if [[ "$cpu_model" =~ ^(151|154|170|172|183|186|189|191|204)$ ]]; then
     omarchy-pkg-add intel-lpmd
-    systemctl enable intel_lpmd.service
+    sudo systemctl enable intel_lpmd.service
   fi
 fi
diff --git a/install/config/hardware/intel/thermald.sh b/install/config/hardware/intel/thermald.sh
index 6a901d60..3ccd4340 100644
--- a/install/config/hardware/intel/thermald.sh
+++ b/install/config/hardware/intel/thermald.sh
@@ -7,6 +7,6 @@ if omarchy-hw-intel; then
   cpu_model=${cpu_model:-0}
   if ((cpu_model >= 42)) && omarchy-battery-present; then
     omarchy-pkg-add thermald
-    systemctl enable thermald.service
+    sudo systemctl enable thermald.service
   fi
 fi
diff --git a/install/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh b/install/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh
index d46c6331..ce0e72ae 100644
--- a/install/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh
+++ b/install/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh
@@ -4,8 +4,8 @@
 # Reference: https://wiki.archlinux.org/title/Lenovo_Yoga_9i_2022_(14AiPI7)
 
 if omarchy-hw-match "Yoga Pro 7 14IAH10"; then
-  mkdir -p /etc/modprobe.d
-  cat > /etc/modprobe.d/lenovo-yoga-pro7-bass.conf <<'EOF'
+  sudo mkdir -p /etc/modprobe.d
+  sudo tee /etc/modprobe.d/lenovo-yoga-pro7-bass.conf >/dev/null <<'EOF'
 options snd-sof-intel-hda-generic hda_model=alc287-yoga9-bass-spk-pin
 EOF
 fi
diff --git a/install/config/hardware/set-wireless-regdom.sh b/install/config/hardware/set-wireless-regdom.sh
index 7a9fdd12..0a5f6f81 100644
--- a/install/config/hardware/set-wireless-regdom.sh
+++ b/install/config/hardware/set-wireless-regdom.sh
@@ -20,5 +20,5 @@ if [[ ! $country =~ ^[A-Z]{2}$ && -n $timezone && -f $zone_tab ]]; then
 fi
 
 if [[ $country =~ ^[A-Z]{2}$ ]]; then
-  echo "WIRELESS_REGDOM=\"$country\"" >> "$regdom_file"
+  echo "WIRELESS_REGDOM=\"$country\"" | sudo tee -a "$regdom_file" >/dev/null
 fi