diff --git a/roles/configuration/tasks/sudo.yml b/roles/configuration/tasks/sudo.yml
index 10a64f7..9410fc1 100644
--- a/roles/configuration/tasks/sudo.yml
+++ b/roles/configuration/tasks/sudo.yml
@@ -15,7 +15,7 @@
     validate: /usr/sbin/visudo --check --file=%s
 
 - name: Deploy per-user sudoers rules
-  when: item.value.sudo | default(false)
+  when: item.value.sudo is defined and (item.value.sudo | string | length > 0)
   vars:
     configuration_sudoers_rule: >-
       {{ item.value.sudo if item.value.sudo is string else 'ALL=(ALL) NOPASSWD: ALL' }}