diff --git a/data/fwupd.service.in b/data/fwupd.service.in
index 384155617..0110ea8cb 100644
--- a/data/fwupd.service.in
+++ b/data/fwupd.service.in
@@ -16,5 +16,5 @@ ProtectKernelModules=yes
 ProtectSystem=full
 RestrictAddressFamilies=AF_NETLINK AF_UNIX
 RestrictRealtime=yes
-ReadWritePaths=@localstatedir@/lib/fwupd -@bootdir@
+ReadWritePaths=@localstatedir@/lib/fwupd @sysconfdir@/fwupd/remotes.d -@bootdir@
 SystemCallFilter=~@mount
diff --git a/data/meson.build b/data/meson.build
index 7938381dd..1a01c440a 100644
--- a/data/meson.build
+++ b/data/meson.build
@@ -37,6 +37,7 @@ con2.set('bindir',
 con2.set('localstatedir', join_paths(get_option('localstatedir')))
 con2.set('datadir', join_paths(get_option('datadir')))
 con2.set('bootdir', get_option('with-bootdir'))
+con2.set('sysconfdir', default_sysconfdir)
 
 # replace @libexecdir@
 configure_file(
@@ -61,7 +62,7 @@ if get_option('enable-systemd')
 endif
 
 if get_option('enable-systemd')
-  # replace @localstatedir@ and @bootdir@
+  # replace @localstatedir@, @sysconfdir@ and @bootdir@
   configure_file(
     input : 'fwupd.service.in',
     output : 'fwupd.service',