diff --git a/install.sh b/install.sh
index edc0d7e..b74629b 100755
--- a/install.sh
+++ b/install.sh
@@ -125,6 +125,7 @@ install_data misc_systemd_units/enable_overcommit_memory.service "$DESTDIR$syste
 install_data misc_systemd_units/gdm.service              "$DESTDIR$systemdunitdir/gdm.service"
 install_data misc_systemd_units/startup-tags.service     "$DESTDIR$systemdunitdir/startup-tags.service"
 install_data misc_systemd_units/unbound.service          "$DESTDIR$systemdunitdir/unbound.service"
+install_exec misc_systemd_units/unbound-startup          "$DESTDIR$usr_sbindir/unbound-startup"
 install_data misc_systemd_units/xaruba.service           "$DESTDIR$systemdunitdir/xaruba.service"
 install_data misc_systemd_units/yppasswd.service         "$DESTDIR$systemdunitdir/yppasswd.service"
 install_data misc_systemd_units/ypserv.service           "$DESTDIR$systemdunitdir/ypserv.service"
diff --git a/misc_systemd_units/unbound-startup b/misc_systemd_units/unbound-startup
new file mode 100755
index 0000000..c592f46
--- /dev/null
+++ b/misc_systemd_units/unbound-startup
@@ -0,0 +1,38 @@
+#! /bin/sh
+
+#
+# unbound is usuually started  via systemd.
+# only setup-var option is used by unbound.service
+
+
+function setup_var() {
+	test -d /var/unbound || { mkdir -p /var/unbound;chown unbound /var/unbound; }
+	test -e /var/unbound/root.key -a /var/unbound/root.key -nt /etc/unbound/root.key || {
+		cp /etc/unbound/root.key /var/unbound/root.key
+		chown unbound /var/unbound/root.key
+	}	
+}
+
+
+
+case $* in
+	start)
+		setup_var
+		unbound-control start
+		;;
+	stop)
+		unbound-control stop
+		;;
+	debug)
+		setup_var
+		unbound -dd -v
+		;;
+	setup-var)
+		setup_var
+		;;
+
+	*)
+		echo "usage: $0 [start | stop]"
+		exit 1
+		;;
+esac