diff --git a/__main__.py b/__main__.py
index 381efa3..873a735 100644
--- a/__main__.py
+++ b/__main__.py
@@ -39,11 +39,14 @@
         sleep 5
     done
 
-    # NOTE: Bounded like the wait above. `cloud-init status --wait` holds for
-    # as long as it takes, and a boot that never ends would otherwise hold the
-    # update with it. 124 is what the timeout itself exits with.
+    # NOTE: `cloud-init status --wait` can wait forever if a boot gets stuck,
+    # so we cap it with a timeout, just like the SSH wait above. When time
+    # runs out, `timeout` exits with 124.
+    # NOTE: We need sudo here. On Rocky, installing a package locks
+    # /run/cloud-init down to root, and `cloud-init status` then fails for
+    # the SSH user.
     booted=0
-    timeout {timeout} ssh -F {config} "$host" cloud-init status --wait || booted=$?
+    timeout {timeout} ssh -F {config} "$host" sudo -n cloud-init status --wait || booted=$?
     if [ "$booted" -eq 124 ]; then
         echo "$host was still booting after {timeout}s" >&2
         exit 1