diff --git a/birdnet-pi/rootfs/etc/sudoers.d/birdnet-abc-systemctl b/birdnet-pi/rootfs/etc/sudoers.d/birdnet-abc-systemctl
new file mode 100644
index 0000000000..9913d6f5f1
--- /dev/null
+++ b/birdnet-pi/rootfs/etc/sudoers.d/birdnet-abc-systemctl
@@ -0,0 +1,3 @@
+# BirdNET-Pi's upstream restart_services.sh is executed by the LinuxServer abc user.
+# Permit only the container-local systemctl replacement required to manage BirdNET services.
+abc ALL=(root) NOPASSWD: /bin/systemctl, /usr/bin/systemctl