diff --git a/archlinux/PKGBUILD.in b/archlinux/PKGBUILD.in
index 2fcbe127..27e6dcb8 100644
--- a/archlinux/PKGBUILD.in
+++ b/archlinux/PKGBUILD.in
@@ -119,6 +119,10 @@ package_qubes-vm-core() {
     install -m 0755 "package-managers/upgrades-installed-check" "${pkgdir}/usr/lib/qubes/"
     install -m 0755 "package-managers/upgrades-status-notify" "${pkgdir}/usr/lib/qubes/"
 
+    # Patch for /etc/sudoers default secure_path
+    install -d -m 0750 "${pkgdir}/etc/sudoers.d"
+    install -m 0440 "archlinux/PKGBUILD.qubes-secure-path.sudo" "${pkgdir}/etc/sudoers.d/qubes_secure_path"
+
     # Archlinux specific: enable autologin on tty1
     mkdir -p "$pkgdir/etc/systemd/system/getty@tty1.service.d/"
     cat <<EOF > "$pkgdir/etc/systemd/system/getty@tty1.service.d/autologin.conf"
diff --git a/archlinux/PKGBUILD.qubes-secure-path.sudo b/archlinux/PKGBUILD.qubes-secure-path.sudo
new file mode 100644
index 00000000..a4c71896
--- /dev/null
+++ b/archlinux/PKGBUILD.qubes-secure-path.sudo
@@ -0,0 +1,3 @@
+Defaults secure_path="/run/qubes/bin:/usr/local/sbin:/usr/local/bin:/usr/bin"
+
+# vim: ft=sudoers