diff --git a/manifests/unbound.pp b/manifests/unbound.pp
index 19f4fd3..75cbcf3 100644
--- a/manifests/unbound.pp
+++ b/manifests/unbound.pp
@@ -1,36 +1,37 @@
 # Parameters for the unbound DNS resolver
 class profile::unbound {
   $has_local_cache = hiera('dns::local_cache')
 
   $package = 'unbound'
   $service = 'unbound'
   $forwarders_file = '/etc/unbound/unbound.conf.d/forwarders.conf'
 
   if $has_local_cache {
     $forwarders = hiera('dns::forwarders')
     $forward_zones = hiera('dns::forward_zones')
 
     package {$package:
       ensure => installed,
     }
 
     service {$service:
-      ensure  => started,
+      ensure  => running,
       enable  => true,
       require => [
         Package[$package],
         File[$forwarders_file],
       ]
     }
 
     # uses variables $forwarders, $forward_zones
     file {'/etc/unbound/unbound.conf.d/forwarders.conf':
       ensure  => present,
       owner   => 'root',
       group   => 'root',
+      mode    => '0644',
       content => template('profile/unbound/forwarders.conf.erb'),
       require => Package[$package],
       notify  => Service[$service],
     }
   }
 }