diff --git a/script/infra-setup.sh b/script/infra-setup.sh
index 674b3a2..f693683 100755
--- a/script/infra-setup.sh
+++ b/script/infra-setup.sh
@@ -75,16 +75,18 @@ SUDOERS
     "
 }
 
-API_SUDOERS='# Scoped deploy permissions for newsfeed api+worker on this host.
+API_SUDOERS='# Scoped deploy permissions for newsfeed api+worker+modelwatch on this host.
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /usr/local/bin/newsfeed-api
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /usr/local/bin/newsfeed-worker
+gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /usr/local/bin/newsfeed-modelwatch
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /etc/newsfeed/config.toml
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /etc/newsfeed/worker.toml
+gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /etc/newsfeed/modelwatch.toml
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl daemon-reload
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl restart newsfeed-api.service
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl restart newsfeed-worker.service
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl is-active newsfeed-api.service
-gitea_ci ALL=(root) NOPASSWD: /usr/sbin/restorecon -R /usr/local/bin/newsfeed-api /usr/local/bin/newsfeed-worker /etc/newsfeed /var/lib/newsfeed'
+gitea_ci ALL=(root) NOPASSWD: /usr/sbin/restorecon -R /usr/local/bin/newsfeed-api /usr/local/bin/newsfeed-worker /usr/local/bin/newsfeed-modelwatch /etc/newsfeed /var/lib/newsfeed'
 
 WEB_SUDOERS='# Scoped deploy permissions for the newsfeed SPA on the oolon proxy.
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /var/www/newsfeed/