Even better, add doas-sudo-shim to your system packages and disable sudo:

  security = {
    doas.enable = true;
    sudo.enable = false;
  };

  environment.systemPackages = [ pkgs.doas-sudo-shim ];