diff --git a/bin/blob-network-dns b/bin/blob-network-dns
index c2ae01e..7333111 100755
--- a/bin/blob-network-dns
+++ b/bin/blob-network-dns
@@ -40,32 +40,15 @@ provider_from_arg() {
   esac
 }
 
-# The path etc/sudoers.d/blob-network-dns names. The privileged half always runs from
-# there rather than from whichever copy was invoked, so the rule matches even
-# where $BLOB_PATH points at a checkout.
-PACKAGED_PATH=/usr/bin/blob-network-dns
-
-# True when sudo would run this exact command without stopping for a password.
-# `sudo -l` on its own reports whether a command is permitted, which the blanket
-# %wheel rule answers yes to for everything; the long listing prints the matched
-# entry's tags, so !authenticate is the grant in etc/sudoers.d/blob-network-dns and
-# nothing else. Listing runs nothing and, under -n, prompts for nothing, so a
-# machine whose blob-settings predates that file falls through to polkit
-# instead of dying on a password prompt it has no terminal to show.
-sudo_grants_passwordless() {
-  sudo -n -l -l "$PACKAGED_PATH" "$@" 2>/dev/null | grep -q '!authenticate'
-}
+script_path=$(readlink -f "${BASH_SOURCE[0]}")
 
 require_root() {
   if (( EUID == 0 )); then
     return
-  elif [[ -t 0 ]] || sudo_grants_passwordless "$@"; then
-    # A terminal can carry sudo's own password prompt. Without one, sudo is
-    # right only where the grant reaches; polkit can at least put a prompt on
-    # screen, and offer to authenticate as someone else.
-    exec sudo "$PACKAGED_PATH" "$@"
+  elif [[ -t 0 ]]; then
+    exec sudo "$script_path" "$@"
   else
-    exec pkexec "$PACKAGED_PATH" "$@"
+    exec pkexec "$script_path" "$@"
   fi
 }