diff --git a/lab-sudo.yml b/lab-sudo.yml
new file mode 100644
index 0000000000..1b80308d3e
--- /dev/null
+++ b/lab-sudo.yml
@@ -0,0 +1,14 @@
+---
+- name: "🔓 Let the lab's administrator escalate without a prompt"
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: "🔓 Drop the lab sudoers override"
+      ansible.builtin.copy:
+        content: "administrator ALL=(ALL) NOPASSWD: ALL\n"
+        dest: /etc/sudoers.d/zz-swarm-lab-administrator
+        owner: root
+        group: root
+        mode: "0440"
+        validate: "visudo -cf %s"
diff --git a/utils/tests/swarm/matrix.py b/utils/tests/swarm/matrix.py
index fc38b54bce..28a31cbbf7 100644
--- a/utils/tests/swarm/matrix.py
+++ b/utils/tests/swarm/matrix.py
@@ -15,6 +15,7 @@ from utils.tests.swarm.extend_inventory import mesh_enabled
 from utils.tests.swarm.mesh import (
     bootstrap_mesh,
     converge_mesh,
+    lab_sudo_without_prompt,
     mesh_controller,
     switch_to_mesh_transport,
     transport_bench,
@@ -276,6 +277,8 @@ def _mesh_prologue(
         round_variants: the round's ``{app_id: variant_index}`` map.
     """
     rc = bootstrap_mesh(inv_dir=inv_dir)
+    if rc == 0:
+        rc = lab_sudo_without_prompt(inv_dir=inv_dir)
     if rc == 0:
         rc = _reset_credentials(
             app_id=app_id, inv_dir=inv_dir, round_variants=round_variants
diff --git a/utils/tests/swarm/mesh.py b/utils/tests/swarm/mesh.py
index 56c146d062..ebbbe9df47 100644
--- a/utils/tests/swarm/mesh.py
+++ b/utils/tests/swarm/mesh.py
@@ -14,6 +14,7 @@ _MESH_NAME = "swarm"
 _CONTROLLER = "localhost"
 _PLAYBOOK = "playbook-mesh.yml"
 _BENCH_PLAYBOOK = "transport-bench.yml"
+_SUDO_PLAYBOOK = "lab-sudo.yml"
 _SWARM_EXTRAS_VARS = "inventories/development/swarm.yml"
 _DEFAULT_ADMIN_KEY = "/tmp/swarm-nfs-admin.key"  # noqa: S108 - ephemeral swarm-test path, overridable via KEY_PATH
 
@@ -131,6 +132,37 @@ def mesh_controller(*, inv_dir: str) -> int:
     )
 
 
+def lab_sudo_without_prompt(*, inv_dir: str) -> int:
+    """Take the sudo prompt off the lab's administrator before the switch.
+
+    Measured over the mesh, an escalated module call costs 1046ms more than an
+    unescalated one, while over the container connection -- which runs as root
+    and so never prompts -- escalation is free. The prompt, not the transport,
+    is what the meshed arm was paying: SSH through the tunnel is itself faster
+    per call than docker exec.
+
+    Runs while the inventory still reaches the nodes as root, so it is in place
+    before anything logs in as the administrator.
+
+    Args:
+        inv_dir: inventory directory of the round.
+    """
+    if not mesh_enabled():
+        return 0
+    return run_step(
+        [
+            "ansible-playbook",
+            "-i",
+            f"{inv_dir}/devices.yml",
+            "--vault-password-file",
+            f"{inv_dir}/.password",
+            _SUDO_PLAYBOOK,
+        ],
+        env=os.environ.copy(),
+        label="take the sudo prompt off the lab administrator",
+    )
+
+
 def transport_bench(*, inv_dir: str, extras_path: str, label: str) -> int:
     """Time a fixed number of module calls over whatever transport is in force.