diff --git a/ncm-sudo/src/main/pan/components/sudo/schema.pan b/ncm-sudo/src/main/pan/components/sudo/schema.pan
index 8840b61787..cd2d22a259 100644
--- a/ncm-sudo/src/main/pan/components/sudo/schema.pan
+++ b/ncm-sudo/src/main/pan/components/sudo/schema.pan
@@ -46,7 +46,9 @@ type sudo_default_options = {
     "mail_no_host" ? boolean
     "mail_no_perms" ? boolean
     "tty_tickets" ? boolean
-    "lecture" ? boolean
+    # old boolean behaviour: true means once, false means never
+    "lecture" ? choice('always', 'once', 'never')
+    "lecture_file" ? absolute_file_path
     "authenticate" ? boolean
     "root_sudo" ? boolean
     "log_host" ? boolean
diff --git a/ncm-sudo/src/main/perl/sudo.pm b/ncm-sudo/src/main/perl/sudo.pm
index 24ab11cb57..aec62803c0 100755
--- a/ncm-sudo/src/main/perl/sudo.pm
+++ b/ncm-sudo/src/main/perl/sudo.pm
@@ -73,7 +73,6 @@ use constant BOOLEAN_OPTS => qw(
     mail_no_host
     mail_no_perms
     tty_tickets
-    lecture
     authenticate
     root_sudo
     log_host
@@ -124,6 +123,8 @@ use constant STRING_OPTS => qw(
     verifypw
     listpw
     secure_path
+    lecture
+    lecture_file
 );
 
 # generate_aliases method