diff --git a/config.example.toml b/config.example.toml
index 3b1f6ced..6a566a99 100644
--- a/config.example.toml
+++ b/config.example.toml
@@ -89,3 +89,7 @@
 [firmware]
 # Offer to update firmware; if false just check for and display available updates
 #upgrade = true
+
+[flatpak]
+# Use sudo for updating the system-wide installation
+#use_sudo = true
diff --git a/src/config.rs b/src/config.rs
index 186c35e2..c9e10d33 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -161,6 +161,13 @@ pub struct Firmware {
     upgrade: Option<bool>,
 }
 
+#[derive(Deserialize, Default, Debug)]
+#[serde(deny_unknown_fields)]
+#[allow(clippy::upper_case_acronyms)]
+pub struct Flatpak {
+    use_sudo: Option<bool>,
+}
+
 #[derive(Deserialize, Default, Debug)]
 #[serde(deny_unknown_fields)]
 pub struct Brew {
@@ -221,6 +228,7 @@ pub struct ConfigFile {
     npm: Option<NPM>,
     firmware: Option<Firmware>,
     vagrant: Option<Vagrant>,
+    flatpak: Option<Flatpak>,
 }
 
 fn config_directory(base_dirs: &BaseDirs) -> PathBuf {
@@ -747,6 +755,15 @@ impl Config {
             .unwrap_or(false)
     }
 
+    #[cfg(target_os = "linux")]
+    pub fn flatpak_use_sudo(&self) -> bool {
+        self.config_file
+            .flatpak
+            .as_ref()
+            .and_then(|flatpak| flatpak.use_sudo)
+            .unwrap_or(false)
+    }
+
     #[cfg(target_os = "linux")]
     str_value!(linux, emerge_sync_flags);
 
diff --git a/src/main.rs b/src/main.rs
index b779ebe4..240d74b5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -315,7 +315,7 @@ fn run() -> Result<()> {
 
     #[cfg(target_os = "linux")]
     {
-        runner.execute(Step::Flatpak, "Flatpak", || linux::flatpak_update(run_type))?;
+        runner.execute(Step::Flatpak, "Flatpak", || linux::flatpak_update(&ctx))?;
         runner.execute(Step::Snap, "snap", || linux::run_snap(sudo.as_ref(), run_type))?;
     }
 
diff --git a/src/steps/os/linux.rs b/src/steps/os/linux.rs
index e263704f..1094dc5e 100644
--- a/src/steps/os/linux.rs
+++ b/src/steps/os/linux.rs
@@ -534,18 +534,30 @@ pub fn run_fwupdmgr(ctx: &ExecutionContext) -> Result<()> {
     updmgr.check_run_with_codes(&[2])
 }
 
-pub fn flatpak_update(run_type: RunType) -> Result<()> {
+pub fn flatpak_update(ctx: &ExecutionContext) -> Result<()> {
     let flatpak = require("flatpak")?;
+    let sudo = require_option(ctx.sudo().as_ref(), String::from("sudo is not installed"))?;
+    let run_type = ctx.run_type();
     print_separator("Flatpak User Packages");
 
     run_type
         .execute(&flatpak)
         .args(&["update", "--user", "-y"])
         .check_run()?;
-    run_type
-        .execute(&flatpak)
-        .args(&["update", "--system", "-y"])
-        .check_run()
+
+    print_separator("Flatpak System Packages");
+    if ctx.config().flatpak_use_sudo() {
+        run_type
+            .execute(sudo)
+            .arg(flatpak)
+            .args(&["update", "--system", "-y"])
+            .check_run()
+    } else {
+        run_type
+            .execute(&flatpak)
+            .args(&["update", "--system", "-y"])
+            .check_run()
+    }
 }
 
 pub fn run_snap(sudo: Option<&PathBuf>, run_type: RunType) -> Result<()> {