diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ef773a2..c50806f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,10 @@ Notable changes to this project are documented in the current file. For more
 details about individual changes, see the Git log. You should read this before
 upgrading Freposte.io as some changes will include useful notes.
 
+v1.6.1 - unreleased
+-------------------
+- Enhancement: Make Unbound drop privileges after binding to port
+
 v1.6.0 - 2019-01-18
 -------------------
 
diff --git a/services/unbound/unbound.conf b/services/unbound/unbound.conf
index d54cbfbc..8abd4325 100644
--- a/services/unbound/unbound.conf
+++ b/services/unbound/unbound.conf
@@ -10,7 +10,7 @@ server:
   do-daemonize: no
   access-control: {{ SUBNET }} allow
   directory: "/etc/unbound"
-  username: root
+  username: unbound
   auto-trust-anchor-file: trusted-key.key
   root-hints: "/etc/unbound/root.hints"
   hide-identity: yes