--- dnssec-trigger.orig/01-dnssec-trigger.in
+++ dnssec-trigger/01-dnssec-trigger.in
@@ -23,7 +23,7 @@ fi
 # set PATH correctly instead of absolute paths to binaries
 PATH="@sbindir@:@bindir@:/sbin:/usr/sbin:/bin:/usr/bin"
 
-state_dir="/var/run/dnssec-trigger"
+state_dir="/run/dnssec-trigger"
 validate_forward_zones="no"
 
 # implementation
--- dnssec-trigger.orig/Makefile.in
+++ dnssec-trigger/Makefile.in
@@ -373,11 +373,12 @@ windows-hook-uninstall:
 
 networkmanager-hook-install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(networkmanager_dispatcher_dir)
-	$(INSTALL) -m 755 -d $(DESTDIR)/etc
+	$(INSTALL) -m 755 -d $(DESTDIR)/etc/dnssec-trigger
 	$(INSTALL) -m 755 -d $(DESTDIR)/lib/systemd/system
+	$(INSTALL) -m 755 -d $(DESTDIR)/usr/lib/dnssec-trigger
 	$(INSTALL) -c -m 755 01-dnssec-trigger $(DESTDIR)$(networkmanager_dispatcher_dir)/01-dnssec-trigger
-	$(INSTALL) -c -m 755 dnssec-trigger-script $(DESTDIR)$(libexecdir)/dnssec-trigger-script
-	$(INSTALL) -c -m 644 dnssec.conf $(DESTDIR)/etc/dnssec.conf
+	$(INSTALL) -c -m 755 dnssec-trigger-script $(DESTDIR)/usr/lib/dnssec-trigger/dnssec-trigger-script
+	$(INSTALL) -c -m 644 dnssec.conf $(DESTDIR)/etc/dnssec-trigger/dnssec.conf
 	$(INSTALL) -c -m 644 dnssec-triggerd.service $(DESTDIR)/lib/systemd/system/dnssec-triggerd.service
 	$(INSTALL) -c -m 644 dnssec-triggerd-keygen.service $(DESTDIR)/lib/systemd/system/dnssec-triggerd-keygen.service
 
@@ -385,7 +386,7 @@ networkmanager-hook-uninstall:
 	@echo "attempt to restore resolv.conf mutability"
 	$(DESTDIR)$(sbindir)/dnssec-triggerd$(EXEEXT) -u
 	rm -f $(DESTDIR)$(networkmanager_dispatcher_dir)/01-dnssec-trigger
-	rm -f $(DESTDIR)$(libexecdir)/dnssec-trigger-script
+	rm -f $(DESTDIR)/usr/lib/dnssec-trigger/dnssec-trigger-script
 	rm -f $(DESTDIR)/etc/dnssec.conf
 	rm -f $(DESTDIR)/lib/systemd/system/dnssec-triggerd.service
 	rm -f $(DESTDIR)/lib/systemd/system/dnssec-triggerd-keygen.service
--- dnssec-trigger.orig/configure.ac
+++ dnssec-trigger/configure.ac
@@ -495,8 +495,8 @@ AC_DEFINE_UNQUOTED([CONFIGFILE], ["$conf
 AC_SUBST(configfile)
 
 AC_ARG_WITH([pidfile], AC_HELP_STRING([--with-pidfile=path],
-[set the pidfile to use, default /var/run/dnssec-trigger.pid]),, withval="")
-pidfile="/var/run/dnssec-trigger.pid"
+[set the pidfile to use, default /run/dnssec-trigger.pid]),, withval="")
+pidfile="/run/dnssec-trigger.pid"
 if test -n "$withval"; then
 	pidfile="$withval"
 fi
--- dnssec-trigger.orig/dnssec-trigger-script.in
+++ dnssec-trigger/dnssec-trigger-script.in
@@ -27,7 +27,7 @@ class UserError(Exception):
 class Config:
     """Global configuration options"""
 
-    path = "/etc/dnssec.conf"
+    path = "/etc/dnssec-trigger/dnssec.conf"
     validate_connection_provided_zones = True
     add_wifi_provided_zones = False
 
@@ -245,7 +245,7 @@ class Store:
     def __init__(self, name):
         self.name = name
         self.cache = set()
-        self.path = os.path.join("/var/run/dnssec-trigger", name)
+        self.path = os.path.join("/run/dnssec-trigger", name)
         self.path_tmp = self.path + ".tmp"
 
         try:
@@ -336,7 +336,7 @@ class Application:
         self.client = NMClient.Client()
 
         self.resolvconf = "/etc/resolv.conf"
-        self.resolvconf_backup = "/var/run/dnssec-trigger/resolv.conf.bak"
+        self.resolvconf_backup = "/run/dnssec-trigger/resolv.conf.bak"
 
     def nm_handles_resolv_conf(self):
         if not self.client.get_manager_running():
@@ -357,7 +357,7 @@ class Application:
         raise UserError("Usage: dnssec-trigger-script [--debug] [--async] --prepare|--update|--update-global-forwarders|--update-connection-zones|--cleanup")
 
     def run(self):
-        with lockfile.FileLock("/var/run/dnssec-trigger/dnssec-trigger"):
+        with lockfile.FileLock("/run/dnssec-trigger/dnssec-trigger"):
             log.debug("Running: {}".format(self.method.__name__))
             self.method()
 
@@ -375,10 +375,10 @@ class Application:
         unbound_zones = UnboundZoneConfig()
 
         # provide upgrade path for previous versions
-        old_zones = glob.glob("/var/run/dnssec-trigger/????????-????-????-????-????????????")
+        old_zones = glob.glob("/run/dnssec-trigger/????????-????-????-????-????????????")
         if old_zones:
             log.info("Reading zones from the legacy zone store")
-            with open("/var/run/dnssec-trigger/zones", "a") as target:
+            with open("/run/dnssec-trigger/zones", "a") as target:
                 for filename in old_zones:
                     with open(filename) as source:
                         log.debug("Reading zones from {}".format(filename))