diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51930b272..96fccc5b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@ IMPROVEMENTS:
     Vagrantfile loading [GH-4711, GH-5769]
   - core: add .color? to UI objects to see if they support color [GH-5771]
   - core: ignore hidden directories when searching for boxes [GH-5748, GH-5785]
+  - core: use `config.ssh.sudo_command` to customize the sudo command
+      format [GH-5573]
   - guests/darwin: support inserting generated key [GH-5204]
   - guests/darwin: support mounting SMB shares [GH-5750]
   - guests/fedora: support Fedora 21 [GH-5277]
diff --git a/plugins/communicators/ssh/communicator.rb b/plugins/communicators/ssh/communicator.rb
index c3fb3adf7..8297329f9 100644
--- a/plugins/communicators/ssh/communicator.rb
+++ b/plugins/communicators/ssh/communicator.rb
@@ -451,7 +451,7 @@ module VagrantPlugins
         # need to wrap the shell in a `sudo` call.
         cmd = @machine.config.ssh.shell
         cmd = shell if shell
-        cmd = "sudo -E -H #{cmd}" if sudo
+        cmd = @machine.config.ssh.sudo_command.gsub("%c", cmd) if sudo
         cmd
       end
 
diff --git a/plugins/kernel_v2/config/ssh.rb b/plugins/kernel_v2/config/ssh.rb
index 4040e228b..db793f44b 100644
--- a/plugins/kernel_v2/config/ssh.rb
+++ b/plugins/kernel_v2/config/ssh.rb
@@ -12,6 +12,7 @@ module VagrantPlugins
       attr_accessor :shell
       attr_accessor :proxy_command
       attr_accessor :pty
+      attr_accessor :sudo_command
 
       attr_reader :default
 
@@ -25,6 +26,7 @@ module VagrantPlugins
         @proxy_command = UNSET_VALUE
         @pty           = UNSET_VALUE
         @shell         = UNSET_VALUE
+        @sudo_command  = UNSET_VALUE
 
         @default    = SSHConnectConfig.new
       end
@@ -47,6 +49,10 @@ module VagrantPlugins
         @pty        = false if @pty == UNSET_VALUE
         @shell      = "bash -l" if @shell == UNSET_VALUE
 
+        if @sudo_command == UNSET_VALUE
+          @sudo_command = "sudo -E -H %c"
+        end
+
         @default.username = "vagrant" if @default.username == UNSET_VALUE
         @default.port     = @guest_port if @default.port == UNSET_VALUE
         @default.finalize!
diff --git a/test/unit/plugins/kernel_v2/config/ssh_test.rb b/test/unit/plugins/kernel_v2/config/ssh_test.rb
index 61365518b..15e23a7a0 100644
--- a/test/unit/plugins/kernel_v2/config/ssh_test.rb
+++ b/test/unit/plugins/kernel_v2/config/ssh_test.rb
@@ -11,4 +11,11 @@ describe VagrantPlugins::Kernel_V2::SSHConfig do
       expect(subject.default.username).to eq("vagrant")
     end
   end
+
+  describe "#sudo_command" do
+    it "defaults properly" do
+      subject.finalize!
+      expect(subject.sudo_command).to eq("sudo -E -H %c")
+    end
+  end
 end
diff --git a/website/docs/source/v2/vagrantfile/ssh_settings.html.md b/website/docs/source/v2/vagrantfile/ssh_settings.html.md
index dba728d3a..b07835b75 100644
--- a/website/docs/source/v2/vagrantfile/ssh_settings.html.md
+++ b/website/docs/source/v2/vagrantfile/ssh_settings.html.md
@@ -98,3 +98,9 @@ a way to not use a pty, that is recommended instead.
 Vagrant. By default this is `bash -l`. Note that this has no effect on
 the shell you get when you run `vagrant ssh`. This configuration option
 only affects the shell to use when executing commands internally in Vagrant.
+
+<hr>
+
+`config.ssh.sudo_command` - The command to use when executing a command
+with `sudo`. This defaults to `sudo -E -H %c`. The `%c` will be replaced by
+the command that is being executed.