diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index 12c9a84333bf..d6d48af0f877 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -22,6 +22,13 @@ in
       '';
     };
 
+    security.shadow.su.package = lib.mkPackageOption pkgs [ "shadow" "su" ] {
+      extraDescription = ''
+        This can be overridden by other modules (e.g. sudo-rs) to provide
+        an alternative `su` implementation.
+      '';
+    };
+
     security.loginDefs = {
       package = lib.mkPackageOption pkgs "shadow" { };
 
@@ -262,7 +269,7 @@ in
           };
         in
         {
-          su = mkSetuidRoot "${cfg.package.su}/bin/su";
+          su = mkSetuidRoot "${config.security.shadow.su.package}/bin/su";
           sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
           newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
           newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
diff --git a/nixos/modules/security/sudo-rs.nix b/nixos/modules/security/sudo-rs.nix
index 50e50e77b851..7965bbe3c7f3 100644
--- a/nixos/modules/security/sudo-rs.nix
+++ b/nixos/modules/security/sudo-rs.nix
@@ -215,6 +215,8 @@ in
     ];
     security.sudo.enable = lib.mkDefault false;
 
+    security.shadow.su.package = lib.mkDefault cfg.package;
+
     security.sudo-rs.extraRules =
       let
         defaultRule =