diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index 3ddadfa95..6008c1fce 100644
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -6,8 +6,8 @@ Documentation=man:unbound(8)
 WantedBy=multi-user.target
 
 [Service]
-ExecReload=/bin/kill -HUP $MAINPID
-ExecStart=/home/vagrant/unbound_systemd/unbound
+ExecReload=@bindir@/kill -HUP $MAINPID
+ExecStart=@sbindir@/unbound
 NotifyAccess=main
 Type=notify
 CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT
@@ -20,7 +20,7 @@ ProtectControlGroups=true
 ProtectKernelModules=true
 ProtectKernelTunables=true
 ProtectSystem=strict
-ReadWritePaths=/etc/unbound /run
+ReadWritePaths=@sysconfdir@ @localstatedir@ /run
 RestrictAddressFamilies=AF_INET AF_UNIX
 RestrictRealtime=true
 SystemCallArchitectures=native
diff --git a/doc/Changelog b/doc/Changelog
index 7899cdeef..acf73e0b8 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,4 +1,7 @@
-16 May 2017: George
+17 May 2017: Wouter
+	- Fix #1265: contrib/unbound.service contains hardcoded path.
+
+17 May 2017: George
 	- Use qstate's region for IPSECKEY rrset (ipsecmod).
 
 16 May 2017: George