diff --git a/clusters/hlcl1/apps/pihole/chart/helmrelease.yaml b/clusters/hlcl1/apps/pihole/chart/helmrelease.yaml
index 15d22d0..ebd36b4 100644
--- a/clusters/hlcl1/apps/pihole/chart/helmrelease.yaml
+++ b/clusters/hlcl1/apps/pihole/chart/helmrelease.yaml
@@ -51,6 +51,8 @@ spec:
     extraEnvVars:
       TZ: "America/New_York"
       FTLCONF_webserver_port: "80"
+      # app_sudo is required on all nebula replicas for nebula-sync
+      FTLCONF_webserver_api_app_sudo: "true"
     resources:
       limits:
         cpu: 500m