diff --git a/tasks/sudoers.yml b/tasks/sudoers.yml
index a4c8979..d838fc2 100644
--- a/tasks/sudoers.yml
+++ b/tasks/sudoers.yml
@@ -1,7 +1,18 @@
+# see /etc/sudoers.d/README for more info
+
+- name: ensure sudoers directory is present
+  become: true
+  file:
+    path: '/etc/sudoers.d'
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
 - name: copy extra sudoers file
   template:
     src: '{{ item.src }}'
     dest: '{{ item.dest }}'
     owner: root
     group: root
-    mode: '0644'
+    mode: '0440'