add `validate='visudo -c -f %s'` here to check for parsing errors that could potentially lock us out.