diff --git a/api/wireguard.py b/api/wireguard.py
index a1c4e1f..3a6d342 100644
--- a/api/wireguard.py
+++ b/api/wireguard.py
@@ -101,7 +101,9 @@ def run_wg(*args, input: str=None):
     return result.stdout
 
 def run_command(command, *args) -> None:
-    command_path = Path().join('command.sh')
+    # The command must be called on an absolute path so that it's possible
+    # to set up a safe sudoers rule for it.
+    command_path = Path().join('commands.sh')
     subprocess.run(['sudo', command_path.absolute(), command, *args])
 
 def create_route(client_ip: ipaddress) -> None:
diff --git a/commands.sh b/commands.sh
old mode 100644
new mode 100755