diff --git a/modules/services/attic/default.nix b/modules/services/attic/default.nix
index fbdab2b..fe6fe8a 100644
--- a/modules/services/attic/default.nix
+++ b/modules/services/attic/default.nix
@@ -15,6 +15,11 @@ let
     ${
       inputs.attic.packages.${system}.attic-server
     }/bin/atticd --config ${config.services.atticd.configFile} --mode garbage-collector-once
+    # Fail if $SUDO_USER is empty.
+    if [ -z "$SUDO_USER" ]; then
+        printf "This script must be run with sudo.\n"
+        exit 1
+    fi
   '';
 in
 {