diff --git a/nsd.changes b/nsd.changes
index adc90a5..18d2d58 100644
--- a/nsd.changes
+++ b/nsd.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Sat Nov 13 18:17:30 UTC 2021 - Michael Ströder <michael@stroeder.com>
+
+- adjusted SystemCallFilter= in nsd.service
+
 -------------------------------------------------------------------
 Wed Oct 13 12:45:45 UTC 2021 - Michael Ströder <michael@stroeder.com>
 
diff --git a/nsd.service b/nsd.service
index b5a8a50..f18bed5 100644
--- a/nsd.service
+++ b/nsd.service
@@ -38,7 +38,7 @@ RestrictSUIDSGID=yes
 DevicePolicy=closed
 MemoryDenyWriteExecute=yes
 SystemCallArchitectures=native
-SystemCallFilter=~ @clock @cpu-emulation @debug @keyring @module @mount @raw-io @reboot @swap @obsolete @chown @privileged @resources @pkey @setuid
+SystemCallFilter=~ @clock @cpu-emulation @debug @keyring @module @mount @raw-io @reboot @swap @obsolete @resources @pkey
 
 [Install]
 WantedBy=multi-user.target