diff --git a/ods-enforcerd.service b/ods-enforcerd.service
index b660d86..0a3d95b 100644
--- a/ods-enforcerd.service
+++ b/ods-enforcerd.service
@@ -4,7 +4,9 @@ After=syslog.target network.target
 
 [Service]
 Type=forking
-PIDFile=/var/run/opendnssec/enforcerd.pid
+User=ods
+Group=ods
+PIDFile=/run/opendnssec/enforcerd.pid
 EnvironmentFile=-/etc/sysconfig/ods
 ExecStart=/usr/sbin/ods-enforcerd $ODS_ENFORCERD_OPT
 
diff --git a/ods-signerd.service b/ods-signerd.service
index a7b7034..c2218a8 100644
--- a/ods-signerd.service
+++ b/ods-signerd.service
@@ -4,7 +4,9 @@ After=syslog.target network.target ods-enforcerd
 
 [Service]
 Type=simple
-PIDFile=/var/run/opendnssec/signerd.pid
+User=ods
+Group=ods
+PIDFile=/run/opendnssec/signerd.pid
 EnvironmentFile=-/etc/sysconfig/ods
 ExecStart=/usr/sbin/ods-signerd -d $ODS_SIGNERD_OPT
 
diff --git a/opendnssec.spec b/opendnssec.spec
index 736f599..3ae3ddc 100644
--- a/opendnssec.spec
+++ b/opendnssec.spec
@@ -4,7 +4,7 @@
 Summary: DNSSEC key and zone management software
 Name: opendnssec
 Version: 2.1.6
-Release: 4%{?prever}%{?dist}
+Release: 5%{?prever}%{?dist}
 License: BSD
 Url: http://www.opendnssec.org/
 Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
@@ -182,6 +182,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||:
 %systemd_postun_with_restart ods-signerd.service
 
 %changelog
+* Mon Apr 20 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-5
+- Resolves: rhbz#1825812 AVC avc: denied { dac_override } for comm="ods-enforcerd
+
 * Wed Mar 11 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-4
 - Fix migration check to not attempt to check on first install with no db