diff --git a/nsd.nix b/nsd.nix
index 0d8e779..d9cc5ca 100644
--- a/nsd.nix
+++ b/nsd.nix
@@ -979,6 +979,8 @@ in {
     };
 
     systemd = {
+      tmpfiles.rules = [ "d ${stateDir} ${username} ${username} 0700 - -" ];
+
       services = {
         nsd = {
           description = "NSD authoritative only domain name service";