diff --git a/Library/Homebrew/cask/artifact/abstract_uninstall.rb b/Library/Homebrew/cask/artifact/abstract_uninstall.rb
index 6528b5ddc8..97b6e1cd99 100644
--- a/Library/Homebrew/cask/artifact/abstract_uninstall.rb
+++ b/Library/Homebrew/cask/artifact/abstract_uninstall.rb
@@ -106,11 +106,13 @@ module Cask
         all_services.each do |service|
           ohai "Removing launchctl service #{service}"
           booleans.each do |with_sudo|
-            sudo_user = with_sudo ? "root" : ""
+            sudo_user = with_sudo ? "root" : nil
             plist_status = command.run(
               "/bin/launchctl",
-              args: ["list", service],
-              sudo: sudo_user, print_stderr: false
+              args:         ["list", service],
+              sudo:         with_sudo,
+              sudo_user:    sudo_user,
+              print_stderr: false,
             ).stdout
             if plist_status.start_with?("{")
               command.run!("/bin/launchctl", args: ["remove", service], sudo: sudo_user)
@@ -123,13 +125,23 @@ module Cask
             paths.each { |elt| elt.prepend(Dir.home).freeze } unless with_sudo
             paths = paths.map { |elt| Pathname(elt) }.select(&:exist?)
             paths.each do |path|
-              command.run!("/bin/rm", args: ["-f", "--", path], sudo: sudo_user)
+              command.run!("/bin/rm", args: ["-f", "--", path], sudo: with_sudo, sudo_user: sudo_user)
             end
             # undocumented and untested: pass a path to uninstall :launchctl
             next unless Pathname(service).exist?
 
-            command.run!("/bin/launchctl", args: ["unload", "-w", "--", service], sudo: sudo_user)
-            command.run!("/bin/rm", args: ["-f", "--", service], sudo: sudo_user)
+            command.run!(
+              "/bin/launchctl",
+              args:      ["unload", "-w", "--", service],
+              sudo:      with_sudo,
+              sudo_user: sudo_user,
+            )
+            command.run!(
+              "/bin/rm",
+              args:      ["-f", "--", service],
+              sudo:      with_sudo,
+              sudo_user: sudo_user,
+            )
             sleep 1
           end
         end
@@ -302,15 +314,35 @@ module Cask
       def uninstall_kext(*kexts, command: nil, **_)
         kexts.each do |kext|
           ohai "Unloading kernel extension #{kext}"
-          is_loaded = system_command!("/usr/sbin/kextstat", args: ["-l", "-b", kext], sudo: "root").stdout
+          is_loaded = system_command!(
+            "/usr/sbin/kextstat",
+            args:      ["-l", "-b", kext],
+            sudo:      true,
+            sudo_user: "root",
+          ).stdout
           if is_loaded.length > 1
-            system_command!("/sbin/kextunload", args: ["-b", kext], sudo: "root")
+            system_command!(
+              "/sbin/kextunload",
+              args:      ["-b", kext],
+              sudo:      true,
+              sudo_user: "root",
+            )
             sleep 1
           end
-          kexts = system_command!("/usr/sbin/kextfind", args: ["-b", kext], sudo: "root").stdout
+          kexts = system_command!(
+            "/usr/sbin/kextfind",
+            args:      ["-b", kext],
+            sudo:      true,
+            sudo_user: "root",
+          ).stdout
           kexts.chomp.lines.each do |kext_path|
             ohai "Removing kernel extension #{kext_path}"
-            system_command!("/bin/rm", args: ["-rf", kext_path], sudo: "root")
+            system_command!(
+              "/bin/rm",
+              args:      ["-rf", kext_path],
+              sudo:      true,
+              sudo_user: "root",
+            )
           end
         end
       end
diff --git a/Library/Homebrew/cask/artifact/pkg.rb b/Library/Homebrew/cask/artifact/pkg.rb
index 7002257be8..b8a000a5b8 100644
--- a/Library/Homebrew/cask/artifact/pkg.rb
+++ b/Library/Homebrew/cask/artifact/pkg.rb
@@ -62,7 +62,7 @@ module Cask
             "USER"     => User.current,
             "USERNAME" => User.current,
           }
-          command.run!("/usr/sbin/installer", sudo: "root", args: args, print_stdout: true, env: env)
+          command.run!("/usr/sbin/installer", sudo: true, sudo_user: "root", args: args, print_stdout: true, env: env)
         end
       end
 
diff --git a/Library/Homebrew/cask/pkg.rb b/Library/Homebrew/cask/pkg.rb
index 15258a420f..6cbda0c9d3 100644
--- a/Library/Homebrew/cask/pkg.rb
+++ b/Library/Homebrew/cask/pkg.rb
@@ -30,9 +30,10 @@ module Cask
         odebug "Deleting pkg files"
         @command.run!(
           "/usr/bin/xargs",
-          args:  ["-0", "--", "/bin/rm", "--"],
-          input: pkgutil_bom_files.join("\0"),
-          sudo:  "root",
+          args:      ["-0", "--", "/bin/rm", "--"],
+          input:     pkgutil_bom_files.join("\0"),
+          sudo:      true,
+          sudo_user: "root",
         )
       end
 
@@ -40,9 +41,10 @@ module Cask
         odebug "Deleting pkg symlinks and special files"
         @command.run!(
           "/usr/bin/xargs",
-          args:  ["-0", "--", "/bin/rm", "--"],
-          input: pkgutil_bom_specials.join("\0"),
-          sudo:  "root",
+          args:      ["-0", "--", "/bin/rm", "--"],
+          input:     pkgutil_bom_specials.join("\0"),
+          sudo:      true,
+          sudo_user: "root",
         )
       end
 
@@ -59,7 +61,7 @@ module Cask
     sig { void }
     def forget
       odebug "Unregistering pkg receipt (aka forgetting)"
-      @command.run!("/usr/sbin/pkgutil", args: ["--forget", package_id], sudo: "root")
+      @command.run!("/usr/sbin/pkgutil", args: ["--forget", package_id], sudo: true, sudo_user: "root")
     end
 
     sig { returns(T::Array[Pathname]) }
@@ -112,9 +114,10 @@ module Cask
     def rmdir(path)
       @command.run!(
         "/usr/bin/xargs",
-        args:  ["-0", "--", RMDIR_SH.to_s],
-        input: Array(path).join("\0"),
-        sudo:  "root",
+        args:      ["-0", "--", RMDIR_SH.to_s],
+        input:     Array(path).join("\0"),
+        sudo:      true,
+        sudo_user: "root",
       )
     end
 
diff --git a/Library/Homebrew/system_command.rb b/Library/Homebrew/system_command.rb
index f9d843561a..a285e6663e 100644
--- a/Library/Homebrew/system_command.rb
+++ b/Library/Homebrew/system_command.rb
@@ -64,7 +64,8 @@ class SystemCommand
     params(
       executable:   T.any(String, Pathname),
       args:         T::Array[T.any(String, Integer, Float, URI::Generic)],
-      sudo:         T.any(T::Boolean, String),
+      sudo:         T::Boolean,
+      sudo_user:    T.nilable(String),
       env:          T::Hash[String, String],
       input:        T.any(String, T::Array[String]),
       must_succeed: T::Boolean,
@@ -81,6 +82,7 @@ class SystemCommand
     executable,
     args: [],
     sudo: false,
+    sudo_user: nil,
     env: {},
     input: [],
     must_succeed: false,
@@ -95,7 +97,11 @@ class SystemCommand
     require "extend/ENV"
     @executable = executable
     @args = args
+
+    raise ArgumentError, "sudo_user cannot be set if sudo is false" if !sudo && !sudo_user.nil?
+
     @sudo = sudo
+    @sudo_user = sudo_user
     env.each_key do |name|
       next if /^[\w&&\D]\w*$/.match?(name)
 
@@ -122,12 +128,7 @@ class SystemCommand
 
   attr_reader :executable, :args, :input, :chdir, :env
 
-  attr_predicate :print_stdout?, :print_stderr?, :must_succeed?
-
-  sig { returns(T::Boolean) }
-  def sudo?
-    @sudo != false && @sudo != ""
-  end
+  attr_predicate :sudo?, :print_stdout?, :print_stderr?, :must_succeed?
 
   sig { returns(T::Boolean) }
   def debug?
@@ -158,7 +159,7 @@ class SystemCommand
 
   sig { returns(T::Array[String]) }
   def sudo_prefix
-    user_flags = @sudo.is_a?(String) ? ["-u", @sudo] : []
+    user_flags = @sudo_user.nil? ? [] : ["-u", @sudo_user]
     askpass_flags = ENV.key?("SUDO_ASKPASS") ? ["-A"] : []
     ["/usr/bin/sudo", *user_flags, *askpass_flags, "-E", *env_args, "--"]
   end