run it as a one-shot service which removes itself when done - this way you avoid the permissions issue.
it would then consist of two files
SAMPLE
A service file /etc/systemd/system/fix-perms.service
[Unit]
Description=Fix installer permissions
After=systemd-logind.service
[Service]
Type=oneshot
RemainAfterExit=no
ExecStart=/etc/fix-perms.sh
[Install]
WantedBy=default.target
A script /etc/fix-perms.sh
#/bin/bash
sed -i ‘s/%wheel ALL=(ALL:ALL) NOPASSWD: ALL/# %wheel ALL=(ALL:ALL) NOPASSWD: ALL/g’ /etc/sudoers
sed -i ‘s/# %wheel ALL=(ALL:ALL) ALL/%wheel ALL=(ALL:ALL) ALL/g’ /etc/sudoers
systemctl disable fix-perms.service
rm -f /etc/systemd/system/fix-perms.service
rm -f /etc/fix-perms.sh