diff --git a/data/fwsignd.service.in b/data/fwsignd.service.in
new file mode 100644
index 000000000..f3a3cc046
--- /dev/null
+++ b/data/fwsignd.service.in
@@ -0,0 +1,11 @@
+[Unit]
+Description=Firmware signing daemon
+
+[Service]
+Type=simple
+# you can set the user to non root if you want, but we're not then able to set
+# the owner to the correct value on files written to the destination directory
+#User=fwsignd
+ExecStart=@servicedir@/fwsignd
+PrivateNetwork=yes
+PrivateTmp=yes