diff --git a/roles/pfsense_upgrade/tasks/upgrade.yml b/roles/pfsense_upgrade/tasks/upgrade.yml
index adb750d..64d8086 100644
--- a/roles/pfsense_upgrade/tasks/upgrade.yml
+++ b/roles/pfsense_upgrade/tasks/upgrade.yml
@@ -38,7 +38,7 @@
 # ---------------------------------------------------------------------------
 - name: Trigger config backup via PHP (writes to /cf/conf/backup/)
   ansible.builtin.raw: >
-    php -r "require_once('/etc/inc/config.inc');
+    sudo php -r "require_once('/etc/inc/config.inc');
     require_once('/etc/inc/util.inc');
     backup_config();"
   register: _backup_result
@@ -73,7 +73,7 @@
 # ---------------------------------------------------------------------------
 - name: "UPGRADE — Running pfSense-upgrade on {{ inventory_hostname }}"
   ansible.builtin.raw: >
-    {{ pfsense_upgrade_bin }} -d -y 2>&1
+    sudo {{ pfsense_upgrade_bin }} -d -y 2>&1
   register: _upgrade_result
   async: 600           # pfSense upgrades can take several minutes
   poll: 10
@@ -97,4 +97,4 @@
     delay: 30
     timeout: "{{ reboot_timeout }}"
     sleep: 10
-  when: auto_reboot | bool
+  when: auto_reboot | bool
\ No newline at end of file