diff --git a/src/steps/generic.rs b/src/steps/generic.rs
index 72dbb2c0..55198b05 100644
--- a/src/steps/generic.rs
+++ b/src/steps/generic.rs
@@ -124,13 +124,11 @@ pub fn run_rubygems(ctx: &ExecutionContext) -> Result<()> {
         || gem_path_str.to_str().unwrap().contains(".rvm")
     {
         ctx.execute(gem).args(["update", "--system"]).status_checked()?;
-    } else {
+    } else if !Path::new("/usr/lib/ruby/vendor_ruby/rubygems/defaults/operating_system.rb").exists() {
         let sudo = ctx.require_sudo()?;
-        if !Path::new("/usr/lib/ruby/vendor_ruby/rubygems/defaults/operating_system.rb").exists() {
-            sudo.execute_opts(ctx, &gem, SudoExecuteOpts::new().preserve_env().set_home())?
-                .args(["update", "--system"])
-                .status_checked()?;
-        }
+        sudo.execute_opts(ctx, &gem, SudoExecuteOpts::new().preserve_env().set_home())?
+            .args(["update", "--system"])
+            .status_checked()?;
     }
 
     Ok(())
@@ -1231,11 +1229,11 @@ pub fn run_bob(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn run_certbot(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let certbot = require("certbot")?;
 
     print_separator("Certbot");
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, &certbot)?.arg("renew").status_checked()
 }
 
@@ -1272,19 +1270,19 @@ pub fn run_platform_io(ctx: &ExecutionContext) -> Result<()> {
 ///
 /// `sudo` will be used if `use_sudo` configuration entry is set to true.
 pub fn run_lensfun_update_data(ctx: &ExecutionContext) -> Result<()> {
-    const SEPARATOR: &str = "Lensfun's database update";
-    let lensfun_update_data = require("lensfun-update-data")?;
     const EXIT_CODE_WHEN_NO_UPDATE: i32 = 1;
 
+    let lensfun_update_data = require("lensfun-update-data")?;
+
+    print_separator("Lensfun's database update");
+
     if ctx.config().lensfun_use_sudo() {
         let sudo = ctx.require_sudo()?;
-        print_separator(SEPARATOR);
         sudo.execute(ctx, &lensfun_update_data)?
             // `lensfun-update-data` returns 1 when there is no update available
             // which should be considered success
             .status_checked_with_codes(&[EXIT_CODE_WHEN_NO_UPDATE])
     } else {
-        print_separator(SEPARATOR);
         ctx.execute(lensfun_update_data)
             .status_checked_with_codes(&[EXIT_CODE_WHEN_NO_UPDATE])
     }
diff --git a/src/steps/os/dragonfly.rs b/src/steps/os/dragonfly.rs
index cf5ef4e9..198842a3 100644
--- a/src/steps/os/dragonfly.rs
+++ b/src/steps/os/dragonfly.rs
@@ -6,9 +6,9 @@ use color_eyre::eyre::Result;
 use rust_i18n::t;
 
 pub fn upgrade_packages(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     print_separator(t!("DragonFly BSD Packages"));
 
+    let sudo = ctx.require_sudo()?;
     let mut cmd = sudo.execute(ctx, "/usr/local/sbin/pkg")?;
     cmd.arg("upgrade");
     if ctx.config().yes(Step::System) {
@@ -18,10 +18,9 @@ pub fn upgrade_packages(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn audit_packages(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
-
     print_separator(t!("DragonFly BSD Audit"));
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, "/usr/local/sbin/pkg")?
         .args(["audit", "-Fr"])
         .status_checked_with(|status| {
diff --git a/src/steps/os/freebsd.rs b/src/steps/os/freebsd.rs
index abb8ea38..1eb80baa 100644
--- a/src/steps/os/freebsd.rs
+++ b/src/steps/os/freebsd.rs
@@ -6,17 +6,18 @@ use color_eyre::Result;
 use rust_i18n::t;
 
 pub fn upgrade_freebsd(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     print_separator(t!("FreeBSD Update"));
+
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, "/usr/sbin/freebsd-update")?
         .args(["fetch", "install"])
         .status_checked()
 }
 
 pub fn upgrade_packages(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     print_separator(t!("FreeBSD Packages"));
 
+    let sudo = ctx.require_sudo()?;
     let mut command = sudo.execute(ctx, "/usr/sbin/pkg")?;
     command.arg("upgrade");
     if ctx.config().yes(Step::System) {
@@ -26,10 +27,9 @@ pub fn upgrade_packages(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn audit_packages(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
-
     print_separator(t!("FreeBSD Audit"));
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, "/usr/sbin/pkg")?
         .args(["audit", "-Fr"])
         .status_checked()
diff --git a/src/steps/os/linux.rs b/src/steps/os/linux.rs
index a328b774..40186e2c 100644
--- a/src/steps/os/linux.rs
+++ b/src/steps/os/linux.rs
@@ -198,24 +198,24 @@ fn update_bedrock(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_alpine_linux(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let apk = require("apk")?;
+    let sudo = ctx.require_sudo()?;
 
     sudo.execute(ctx, &apk)?.arg("update").status_checked()?;
     sudo.execute(ctx, &apk)?.arg("upgrade").status_checked()
 }
 
 fn upgrade_chimera_linux(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let apk = require("apk")?;
+    let sudo = ctx.require_sudo()?;
 
     sudo.execute(ctx, &apk)?.arg("update").status_checked()?;
     sudo.execute(ctx, &apk)?.arg("upgrade").status_checked()
 }
 
 fn upgrade_wolfi_linux(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let apk = require("apk")?;
+    let sudo = ctx.require_sudo()?;
 
     sudo.execute(ctx, &apk)?.arg("update").status_checked()?;
     sudo.execute(ctx, &apk)?.arg("upgrade").status_checked()
@@ -237,8 +237,8 @@ fn upgrade_redhat(ctx: &ExecutionContext) -> Result<()> {
         }
     };
 
-    let sudo = ctx.require_sudo()?;
     let dnf = require_one(["dnf", "yum"])?;
+    let sudo = ctx.require_sudo()?;
 
     let mut command = sudo.execute(ctx, &dnf)?;
     command.arg(if ctx.config().redhat_distro_sync() {
@@ -260,8 +260,8 @@ fn upgrade_redhat(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_nobara(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let dnf = require("dnf")?;
+    let sudo = ctx.require_sudo()?;
 
     let mut update_command = sudo.execute(ctx, &dnf)?;
 
@@ -292,8 +292,8 @@ fn upgrade_nobara(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_nilrt(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let opkg = require("opkg")?;
+    let sudo = ctx.require_sudo()?;
 
     sudo.execute(ctx, &opkg)?.arg("update").status_checked()?;
     sudo.execute(ctx, &opkg)?.arg("upgrade").status_checked()
@@ -315,8 +315,8 @@ fn upgrade_fedora_immutable(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_bedrock_strata(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let brl = require("brl")?;
+    let sudo = ctx.require_sudo()?;
 
     sudo.execute(ctx, &brl)?.arg("update").status_checked()?;
 
@@ -324,8 +324,8 @@ fn upgrade_bedrock_strata(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_suse(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let zypper = require("zypper")?;
+    let sudo = ctx.require_sudo()?;
 
     sudo.execute(ctx, &zypper)?.arg("refresh").status_checked()?;
 
@@ -345,8 +345,8 @@ fn upgrade_suse(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_opensuse_tumbleweed(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let zypper = require("zypper")?;
+    let sudo = ctx.require_sudo()?;
 
     sudo.execute(ctx, &zypper)?.arg("refresh").status_checked()?;
 
@@ -362,8 +362,8 @@ fn upgrade_opensuse_tumbleweed(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_suse_micro(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let upd = require("transactional-update")?;
+    let sudo = ctx.require_sudo()?;
 
     let mut cmd = sudo.execute(ctx, &upd)?;
     if ctx.config().yes(Step::System) {
@@ -376,8 +376,8 @@ fn upgrade_suse_micro(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_openmandriva(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let dnf = require("dnf")?;
+    let sudo = ctx.require_sudo()?;
 
     let mut command = sudo.execute(ctx, &dnf)?;
 
@@ -397,8 +397,8 @@ fn upgrade_openmandriva(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_pclinuxos(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let apt_get = require("apt-get")?;
+    let sudo = ctx.require_sudo()?;
 
     let mut command_update = sudo.execute(ctx, &apt_get)?;
 
@@ -445,8 +445,8 @@ fn upgrade_vanilla(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_void(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let xbps = require("xbps-install")?;
+    let sudo = ctx.require_sudo()?;
 
     let mut command = sudo.execute(ctx, &xbps)?;
     command.args(["-Su", "xbps"]);
@@ -466,8 +466,8 @@ fn upgrade_void(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_gentoo(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let emerge = require("emerge")?;
+    let sudo = ctx.require_sudo()?;
 
     if let Some(layman) = which("layman") {
         sudo.execute(ctx, &layman)?.args(["-s", "ALL"]).status_checked()?;
@@ -596,8 +596,8 @@ pub fn run_deb_get(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_solus(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let eopkg = require("eopkg")?;
+    let sudo = ctx.require_sudo()?;
 
     let mut cmd = sudo.execute(ctx, &eopkg)?;
     if ctx.config().yes(Step::System) {
@@ -684,16 +684,15 @@ pub fn run_pacstall(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn run_pkgfile(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let pkgfile = require("pkgfile")?;
 
     print_separator("pkgfile");
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, pkgfile)?.arg("--update").status_checked()
 }
 
 pub fn run_mandb(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let mandb = require("mandb")?;
 
     if !ctx.config().enable_mandb() {
@@ -702,6 +701,7 @@ pub fn run_mandb(ctx: &ExecutionContext) -> Result<()> {
 
     print_separator(t!("System Manuals"));
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, &mandb)?.status_checked()?;
 
     print_separator(t!("User Manuals"));
@@ -728,8 +728,8 @@ pub fn run_packer_nu(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_clearlinux(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let swupd = require("swupd")?;
+    let sudo = ctx.require_sudo()?;
 
     let mut cmd = sudo.execute(ctx, &swupd)?;
     cmd.arg("update");
@@ -742,9 +742,9 @@ fn upgrade_clearlinux(ctx: &ExecutionContext) -> Result<()> {
 }
 
 fn upgrade_exherbo(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let cave = require("cave")?;
     let eclectic = require("eclectic")?;
+    let sudo = ctx.require_sudo()?;
 
     sudo.execute(ctx, &cave)?.arg("sync").status_checked()?;
 
@@ -794,8 +794,8 @@ fn upgrade_neon(ctx: &ExecutionContext) -> Result<()> {
     // seems rare
     // if that comes up we need to create a Distribution::PackageKit or some such
 
-    let sudo = ctx.require_sudo()?;
     let pkcon = require("pkcon")?;
+    let sudo = ctx.require_sudo()?;
 
     // pkcon ignores update with update and refresh provided together
     sudo.execute(ctx, &pkcon)?.arg("refresh").status_checked()?;
@@ -838,13 +838,13 @@ fn should_skip_needrestart() -> Result<()> {
 }
 
 pub fn run_needrestart(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let needrestart = require("needrestart")?;
 
     should_skip_needrestart()?;
 
     print_separator(t!("Check for needed restarts"));
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, &needrestart)?.status_checked()?;
 
     Ok(())
@@ -875,7 +875,6 @@ pub fn run_fwupdmgr(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn run_flatpak(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let flatpak = require("flatpak")?;
 
     let cleanup = ctx.config().cleanup();
@@ -898,6 +897,7 @@ pub fn run_flatpak(ctx: &ExecutionContext) -> Result<()> {
 
     print_separator(t!("Flatpak System Packages"));
     if ctx.config().flatpak_use_sudo() || std::env::var("SSH_CLIENT").is_ok() {
+        let sudo = ctx.require_sudo()?;
         let mut update_args = vec!["update", "--system"];
         if yes {
             update_args.push("-y");
@@ -929,7 +929,6 @@ pub fn run_flatpak(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn run_snap(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let snap = require("snap")?;
 
     if !PathBuf::from("/var/snapd.socket").exists() && !PathBuf::from("/run/snapd.socket").exists() {
@@ -937,16 +936,17 @@ pub fn run_snap(ctx: &ExecutionContext) -> Result<()> {
     }
     print_separator("snap");
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, &snap)?.arg("refresh").status_checked()
 }
 
 pub fn run_pihole_update(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let pihole = require("pihole")?;
     Path::new("/opt/pihole/update.sh").require()?;
 
     print_separator("pihole");
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, &pihole)?.arg("-up").status_checked()
 }
 
@@ -990,11 +990,12 @@ pub fn run_distrobox_update(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn run_dkp_pacman_update(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let dkp_pacman = require("dkp-pacman")?;
 
     print_separator("Devkitpro pacman");
 
+    let sudo = ctx.require_sudo()?;
+
     sudo.execute(ctx, &dkp_pacman)?.arg("-Syu").status_checked()?;
 
     if ctx.config().cleanup() {
@@ -1005,13 +1006,13 @@ pub fn run_dkp_pacman_update(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn run_config_update(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     if ctx.config().yes(Step::ConfigUpdate) {
         return Err(SkipStep(t!("Skipped in --yes").to_string()).into());
     }
 
     if let Ok(etc_update) = require("etc-update") {
         print_separator(t!("Configuration update"));
+        let sudo = ctx.require_sudo()?;
         sudo.execute(ctx, etc_update)?.status_checked()?;
     } else if let Ok(pacdiff) = require("pacdiff") {
         if std::env::var("DIFFPROG").is_err() {
@@ -1019,6 +1020,7 @@ pub fn run_config_update(ctx: &ExecutionContext) -> Result<()> {
         }
 
         print_separator(t!("Configuration update"));
+        let sudo = ctx.require_sudo()?;
         sudo.execute_opts(ctx, &pacdiff, SudoExecuteOpts::new().preserve_env_list(&["DIFFPROG"]))?
             .status_checked()?;
     }
@@ -1043,7 +1045,6 @@ pub fn run_lure_update(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn run_waydroid(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let waydroid = require("waydroid")?;
 
     let status = ctx.execute(&waydroid).arg("status").output_checked_utf8()?;
@@ -1084,15 +1085,17 @@ pub fn run_waydroid(ctx: &ExecutionContext) -> Result<()> {
             );
         }
     }
+
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, &waydroid)?.arg("upgrade").status_checked()
 }
 
 pub fn run_auto_cpufreq(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let auto_cpu_freq = require("auto-cpufreq")?;
 
     print_separator("auto-cpufreq");
 
+    let sudo = ctx.require_sudo()?;
     sudo.execute(ctx, &auto_cpu_freq)?.arg("--update").status_checked()
 }
 
diff --git a/src/steps/os/macos.rs b/src/steps/os/macos.rs
index 73231d48..6afce4a7 100644
--- a/src/steps/os/macos.rs
+++ b/src/steps/os/macos.rs
@@ -11,10 +11,12 @@ use std::process::Command;
 use tracing::debug;
 
 pub fn run_macports(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let port = require("port")?;
 
     print_separator("MacPorts");
+
+    let sudo = ctx.require_sudo()?;
+
     sudo.execute(ctx, &port)?.arg("selfupdate").status_checked()?;
     sudo.execute(ctx, &port)?
         .args(["-u", "upgrade", "outdated"])
diff --git a/src/steps/os/openbsd.rs b/src/steps/os/openbsd.rs
index cf3a839c..d04b7125 100644
--- a/src/steps/os/openbsd.rs
+++ b/src/steps/os/openbsd.rs
@@ -17,9 +17,10 @@ fn is_openbsd_current(ctx: &ExecutionContext) -> Result<bool> {
 }
 
 pub fn upgrade_openbsd(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     print_separator(t!("OpenBSD Update"));
 
+    let sudo = ctx.require_sudo()?;
+
     let is_current = is_openbsd_current(ctx)?;
 
     if ctx.config().dry_run() {
@@ -35,9 +36,10 @@ pub fn upgrade_openbsd(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn upgrade_packages(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     print_separator(t!("OpenBSD Packages"));
 
+    let sudo = ctx.require_sudo()?;
+
     let is_current = is_openbsd_current(ctx)?;
 
     if ctx.config().dry_run() {
diff --git a/src/steps/os/unix.rs b/src/steps/os/unix.rs
index 54201471..fb054495 100644
--- a/src/steps/os/unix.rs
+++ b/src/steps/os/unix.rs
@@ -199,11 +199,12 @@ pub fn run_oh_my_fish(ctx: &ExecutionContext) -> Result<()> {
 }
 
 pub fn run_pkgin(ctx: &ExecutionContext) -> Result<()> {
-    let sudo = ctx.require_sudo()?;
     let pkgin = require("pkgin")?;
 
     print_separator("Pkgin");
 
+    let sudo = ctx.require_sudo()?;
+
     let mut command = sudo.execute(ctx, &pkgin)?;
     command.arg("update");
     if ctx.config().yes(Step::Pkgin) {