diff --git a/bundles/backup-server/metadata.py b/bundles/backup-server/metadata.py
index 2efc24d..a683f09 100644
--- a/bundles/backup-server/metadata.py
+++ b/bundles/backup-server/metadata.py
@@ -12,7 +12,10 @@ defaults = {
         },
     },
     'sudoers': {
-        'backup-receiver': ['ALL'],
+        'backup-receiver': {
+            '/usr/bin/rsync',
+            '/sbin/zfs',
+        },
     }
 }