diff --git a/ChangeLog b/ChangeLog
index 65f42e7..2e1d55b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+
+0.4.
+-----
+- systemd unit: run as 'daemon' user, not root;
+  packagers should make sure to chown /var/spool/uptimed/
+  on update
+
 0.4.6
 -----
 - better deuplicate entry detection on linux and bsd
diff --git a/etc/uptimed.service.in b/etc/uptimed.service.in
index efb43cd..0809b4a 100644
--- a/etc/uptimed.service.in
+++ b/etc/uptimed.service.in
@@ -7,6 +7,7 @@ After=time-sync.target
 Type=notify
 ExecStart=@prefix@/sbin/uptimed -f
 Restart=on-failure
+User=daemon
 
 [Install]
 WantedBy=multi-user.target