diff --git a/mkosi.extra/usr/bin/set-up-systemd-extension b/mkosi.extra/usr/bin/set-up-systemd-extension
index 32c0702..e2ef8f7 100755
--- a/mkosi.extra/usr/bin/set-up-systemd-extension
+++ b/mkosi.extra/usr/bin/set-up-systemd-extension
@@ -8,7 +8,7 @@ set -e
 
 SYSEXT_BASE_LOCATION="${HOME}/kde/usr/"
 SYSEXT_LOCATION="${SYSEXT_BASE_LOCATION}/lib/extension-release.d/"
-SYSEXT_ROOT_LOCATION=/var/lib/extensions/
+SYSEXT_ROOT_LOCATION="/var/lib/extensions/"
 
 echo
 if [ -f "${SYSEXT_LOCATION}/extension-release.kde" ]; then
@@ -18,22 +18,27 @@ else
     echo "Setting up extension at ${SYSEXT_BASE_LOCATION}..."
 
     # Create directory to hold this system extension
-    mkdir -p ${SYSEXT_LOCATION}
-    sudo mkdir -p ${SYSEXT_ROOT_LOCATION}
-    sudo ln -fs "${HOME}/kde" ${SYSEXT_ROOT_LOCATION}
+    mkdir -p "${SYSEXT_LOCATION}"
 
-    # Copy the system os-release file to be an extension-release file that identifies this extension
-    sudo cp /usr/lib/os-release "${SYSEXT_LOCATION}/extension-release.kde"
+    # Heredoc into run0 so we only have one auth prompt.
+    run0 sh <<EOF
+set -e
+mkdir -p "${SYSEXT_ROOT_LOCATION}"
+ln -fs "${HOME}/kde" "${SYSEXT_ROOT_LOCATION}"
 
-    # Set its ID to "_any" so system updates don't break the extension
-    # Skip this step if you want the extension to only work for the current system build
-    sed -i "s/^ID=.*/ID=_any/g" "${SYSEXT_LOCATION}/extension-release.kde"
+# Copy the system os-release file to be an extension-release file that identifies this extension
+cp /usr/lib/os-release "${SYSEXT_LOCATION}/extension-release.kde"
 
-    # Make the release file immutable so it can't be accidentally removed
-    sudo chattr +i "${SYSEXT_LOCATION}/extension-release.kde"
+# Set its ID to "_any" so system updates don't break the extension
+# Skip this step if you want the extension to only work for the current system build
+sed -i "s/^ID=.*/ID=_any/g" "${SYSEXT_LOCATION}/extension-release.kde"
 
-    # Turn it on!
-    sudo systemd-sysext refresh || sudo systemd-sysext merge
+# Make the release file immutable so it can't be accidentally removed
+chattr +i "${SYSEXT_LOCATION}/extension-release.kde"
 
-    echo "Finished setting up extension! When you put files in ${SYSEXT_BASE_LOCATION} and run 'sudo systemd-sysext refresh', they will appear in /usr/. See https://community.kde.org/KDE_Linux/Add_or_override_content_in_/usr for more information."
+# Turn it on!
+systemd-sysext refresh || systemd-sysext merge
+EOF
+
+    echo "Finished setting up extension! When you put files in ${SYSEXT_BASE_LOCATION} and run 'run0 systemd-sysext refresh', they will appear in /usr/. See https://community.kde.org/KDE_Linux/Add_or_override_content_in_/usr for more information."
 fi
diff --git a/mkosi.extra/usr/bin/toggle-developer-mode b/mkosi.extra/usr/bin/toggle-developer-mode
index cc23b3e..c624479 100755
--- a/mkosi.extra/usr/bin/toggle-developer-mode
+++ b/mkosi.extra/usr/bin/toggle-developer-mode
@@ -14,17 +14,21 @@ org.kde.plasma.lookandfeelexplorer.desktop \
 org.kde.plasma.themeexplorer.desktop \
 org.kde.plasmaengineexplorer.desktop"
 
-function enable_dev_apps
+enable_dev_apps()
 {
     echo "Enabling development apps…"
 
-    run0 mkdir -p "$OPT_APPS_LOCATION" 1> /dev/null
+    # Heredoc into run0 so we only have one auth prompt.
+    run0 sh <<EOF
+set -e
+mkdir -p "$OPT_APPS_LOCATION" 1> /dev/null
 
-    for ITEM in $PREINSTALLED_DEV_APPS; do
-        run0 cp "${USR_APPS_LOCATION}${ITEM}" "${OPT_APPS_LOCATION}${ITEM}" 1> /dev/null
-        run0 sed -i "/NoDisplay=true/d" "${OPT_APPS_LOCATION}${ITEM}" 1> /dev/null
-        echo "- Enabled ${ITEM}"
-    done
+for ITEM in $PREINSTALLED_DEV_APPS; do
+    cp "${USR_APPS_LOCATION}\${ITEM}" "${OPT_APPS_LOCATION}\${ITEM}" 1> /dev/null
+    sed -i "/NoDisplay=true/d" "${OPT_APPS_LOCATION}\${ITEM}" 1> /dev/null
+    echo "- Enabled \${ITEM}"
+done
+EOF
 
     echo "Refreshing app cache…"
     kbuildsycoca6
@@ -33,19 +37,23 @@ function enable_dev_apps
     echo "files were installed in ${OPT_APPS_LOCATION}."
 }
 
-function disable_dev_apps
+disable_dev_apps()
 {
     echo "Hiding development apps…"
 
-    for ITEM in $PREINSTALLED_DEV_APPS; do
-        run0 rm "${OPT_APPS_LOCATION}${ITEM}" 1> /dev/null
-    done
+    # Heredoc into run0 so we only have one auth prompt.
+    run0 sh <<EOF
+set -e
+for ITEM in $PREINSTALLED_DEV_APPS; do
+    rm "${OPT_APPS_LOCATION}\${ITEM}" 1> /dev/null
+done
+
+rmdir --ignore-fail-on-non-empty "$OPT_APPS_LOCATION" 1> /dev/null
+EOF
 
     echo "Refreshing app cache…"
     kbuildsycoca6
 
-    run0 rmdir --ignore-fail-on-non-empty "$OPT_APPS_LOCATION" 1> /dev/null
-
     echo "Done; development apps are now hidden."
 }