diff --git a/data/Makefile.am b/data/Makefile.am
index 0b1417ecb..6446683a2 100644
--- a/data/Makefile.am
+++ b/data/Makefile.am
@@ -18,6 +18,7 @@ $(dbusservicemain_DATA): $(dbusservicemain_in_files) Makefile
 
 %.service: %.service.in Makefile
 	$(AM_V_GEN)sed -e 's|\@servicedir\@|$(libexecdir)|' \
+	               -e 's|\@localstatedir\@|$(localstatedir)|' \
 	               -e 's|\@bindir\@|$(bindir)|' \
 	               -e 's|\@daemon_user\@|$(daemon_user)|' $< > $@.tmp && mv $@.tmp $@
 
@@ -28,8 +29,9 @@ systemdservice_in_files =				\
 systemdservice_DATA = $(systemdservice_in_files:.service.in=.service)
 
 install-data-hook:
-	mkdir -p $(DESTDIR)$(systemdunitdir)/system-update.target.wants
+	$(MKDIR_P) $(DESTDIR)$(systemdunitdir)/system-update.target.wants
 	ln -sf ../fwupd-offline-update.service $(DESTDIR)$(systemdunitdir)/system-update.target.wants/fwupd-offline-update.service
+	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/fwupd
 
 udevrules_DATA =					\
 	90-fwupd-devices.rules
diff --git a/data/fwupd.service.in b/data/fwupd.service.in
index 480bd9684..13041f8a0 100644
--- a/data/fwupd.service.in
+++ b/data/fwupd.service.in
@@ -16,4 +16,4 @@ ProtectKernelModules=yes
 ProtectSystem=full
 RestrictAddressFamilies=AF_NETLINK AF_UNIX
 RestrictRealtime=yes
-ReadWritePaths=/var/lib/fwupd /boot/efi
+ReadWritePaths=@localstatedir@/lib/fwupd /boot/efi