it’s safer to run it as a regular user and have topgrade ask for root access. With this config line it can ask ahead when starting, so you don’t need to babysit it:

[misc]
    # ...
    # Run `sudo -v` to cache credentials at the start of the run; this avoids a
    # blocking password prompt in the middle of a possibly-unattended run.
    pre_sudo = true