diff --git a/abuild-keygen.in b/abuild-keygen.in
index 299d86c..d9ac0bc 100644
--- a/abuild-keygen.in
+++ b/abuild-keygen.in
@@ -8,7 +8,7 @@
 
 program_version=@VERSION@
 sharedir=${ABUILD_SHAREDIR:-@sharedir@}
-SUDO="${SUDO-sudo}"
+SUDO="${SUDO-$(command -v doas || command -v sudo || echo doas)}"
 
 if ! [ -f "$sharedir/functions.sh" ]; then
 	echo "$sharedir/functions.sh: not found" >&2
@@ -98,14 +98,15 @@ usage() {
 		  -a, --append         Set PACKAGER_PRIVKEY=<generated key> in
 		                       $ABUILD_USERCONF
 
-		  -i, --install        Install public key into /etc/apk/keys using sudo
+		  -i, --install        Install public key into /etc/apk/keys using doas
 		  -n                   Non-interactive. Use defaults
 		  -b, --numbits [BITS] The size of the private key to generate in bits.
 		  -q, --quiet
 		  -h, --help           Show this help
 
 		The SUDO variable can be set to pick which tool can be used to
-		elevate privileges, if it is not set it defaults to sudo.
+		elevate privileges, if it is not set it defaults to doas or sudo if doas
+		is not found.
 
 	__EOF__
 }
diff --git a/tests/abuild_keygen_test b/tests/abuild_keygen_test
index 5c97d68..7f22a89 100755
--- a/tests/abuild_keygen_test
+++ b/tests/abuild_keygen_test
@@ -9,7 +9,8 @@ init_tests \
 	abuild_keygen_append \
 	abuild_keygen_install_without_sudo \
 	abuild_keygen_install_interactive \
-	abuild_keygen_install_non_interactive
+	abuild_keygen_install_non_interactive \
+	abuild_keygen_install_doas
 
 export ABUILD_SHAREDIR=$(atf_get_srcdir)/..
 export GIT=false
@@ -79,3 +80,21 @@ abuild_keygen_install_non_interactive_body() {
 		-e match:"Generating RSA" \
 		abuild-keygen --install -n
 }
+
+abuild_keygen_install_doas_body() {
+	mkdir bin
+	cat >bin/doas<<-EOF
+		#!/bin/sh
+		echo "fake doas"
+		"\$@"
+	EOF
+	chmod +x bin/doas
+
+	PATH="$PWD/bin:$PATH" abuild_keygen_install_root="$PWD" \
+		atf_check -s exit:0 \
+		\
+		-o match:"fake doas" \
+		-e match:"Generating RSA" \
+		abuild-keygen --install -n
+}
+