diff --git a/contrib/debian/fwupd.postinst b/contrib/debian/fwupd.postinst
index e300bd862..bb5428e29 100644
--- a/contrib/debian/fwupd.postinst
+++ b/contrib/debian/fwupd.postinst
@@ -48,3 +48,10 @@ for dir in /var/cache/fwupdate /var/lib/fwupdate; do
 	        rmdir --ignore-fail-on-non-empty $dir || true
 	fi
 done
+
+#create a user for fwupd-refresh.service/fwupd-refresh.timer
+adduser --quiet --system --group --no-create-home --home /run/systemd \
+    --gecos "fwupd-refresh user" fwupd-refresh
+if [ -d /run/systemd/system ]; then
+    systemctl reload dbus || true
+fi
diff --git a/contrib/debian/rules b/contrib/debian/rules
index 8cdefa9e2..d517615e3 100755
--- a/contrib/debian/rules
+++ b/contrib/debian/rules
@@ -49,7 +49,7 @@ ifeq (yes,$(shell dpkg-vendor --derives-from Ubuntu && echo yes))
        CONFARGS += -Dplugin_logitech_bulkcontroller=disabled
 endif
 
-CONFARGS += -Dplugin_dummy=true -Dplugin_powerd=disabled -Ddocs=gtkdoc -Dsupported_build=enabled -Dplugin_modem_manager=enabled
+CONFARGS += -Dplugin_dummy=true -Dplugin_powerd=disabled -Ddocs=gtkdoc -Dsupported_build=enabled -Dplugin_modem_manager=enabled -Dsystemd_unit_user=fwupd-refresh
 
 %:
 	dh $@ --with gir
@@ -76,6 +76,9 @@ override_dh_install:
 	rm -f debian/fwupd/usr/lib/*/fwupd-plugins-*/libfu_plugin_invalid.so
 	rm -f debian/fwupd/etc/fwupd/remotes.d/fwupd-tests.conf
 
+	#enable fwupd-refresh.service by default (we have a dedicated user)
+	rm -f debian/fwupd/lib/systemd/system-preset/fwupd-refresh.preset
+
 override_dh_strip_nondeterminism:
 	dh_strip_nondeterminism -Xfirmware-example.xml.gz