diff --git a/CHANGELOG b/CHANGELOG
index 4af99ca..8ecbe9b 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -30,6 +30,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * evobackup: execute canary script before executing backup script
 * accounts: create only users who have a certain value for the `create` key (default: `always`)
 * nagios-nrpe: add the ipmi_sensor check
+* base: doas configuration for ipmi_sensor NRPE check
 
 ### Changed
 
diff --git a/roles/base/tasks/doas.yml b/roles/base/tasks/doas.yml
index 5ba3135..1d4b88b 100644
--- a/roles/base/tasks/doas.yml
+++ b/roles/base/tasks/doas.yml
@@ -24,5 +24,6 @@
       permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_packetfilter.sh
       permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ipsecctl_critiques.sh
       permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_openvpn_certificates.sh
+      permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ipmi_sensor
   tags:
     - doas