diff --git a/.etckeeper b/.etckeeper
index aaba9a58..800059d8 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -953,6 +953,7 @@ maybe chmod 0644 'ld.so.conf.d/libc.conf'
 maybe chmod 0755 'ldap'
 maybe chmod 0644 'ldap/ldap.conf'
 maybe chmod 0755 'letsencrypt'
+maybe chmod 0600 'letsencrypt/.certbot.lock'
 maybe chmod 0700 'letsencrypt/accounts'
 maybe chmod 0700 'letsencrypt/accounts/acme-v01.api.letsencrypt.org'
 maybe chmod 0700 'letsencrypt/accounts/acme-v01.api.letsencrypt.org/directory'
diff --git a/group b/group
index ff6c59c4..d5f6d451 100644
--- a/group
+++ b/group
@@ -61,3 +61,4 @@ systemd-coredump:x:995:
 ovalwonder:x:1002:jgdye
 kvm:x:106:
 ssl-cert:x:117:
+render:x:118:
diff --git a/group- b/group-
index b66b98eb..ff6c59c4 100644
--- a/group-
+++ b/group-
@@ -60,3 +60,4 @@ vnstat:x:116:
 systemd-coredump:x:995:
 ovalwonder:x:1002:jgdye
 kvm:x:106:
+ssl-cert:x:117:
diff --git a/gshadow b/gshadow
index c353a6c8..65623274 100644
--- a/gshadow
+++ b/gshadow
@@ -61,3 +61,4 @@ systemd-coredump:!!::
 ovalwonder:!::jgdye
 kvm:!::
 ssl-cert:!::
+render:!::
diff --git a/gshadow- b/gshadow-
index 8cc89df4..c353a6c8 100644
--- a/gshadow-
+++ b/gshadow-
@@ -60,3 +60,4 @@ vnstat:!::
 systemd-coredump:!!::
 ovalwonder:!::jgdye
 kvm:!::
+ssl-cert:!::
diff --git a/init.d/udev b/init.d/udev
index 6a3c9b39..a10a586c 100755
--- a/init.d/udev
+++ b/init.d/udev
@@ -166,7 +166,8 @@ case "$1" in
 
     log_daemon_msg "Starting $DESC" "$NAME"
     if start-stop-daemon --start --name $NAME --user root --quiet \
-        --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile; then
+        --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile \
+        --notify-await; then
         # prevents udevd to be killed by sendsigs (see #791944)
         mkdir -p $OMITDIR
         ln -sf $PIDFILE $OMITDIR/$NAME
@@ -226,7 +227,8 @@ case "$1" in
 
     log_daemon_msg "Starting $DESC" "$NAME"
     if start-stop-daemon --start --name $NAME --user root --quiet \
-        --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile; then
+        --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile \
+        --notify-await; then
         # prevents udevd to be killed by sendsigs (see #791944)
         mkdir -p $OMITDIR
         ln -sf $PIDFILE $OMITDIR/$NAME
diff --git a/letsencrypt/.certbot.lock b/letsencrypt/.certbot.lock
new file mode 100644
index 00000000..e69de29b
diff --git a/systemd/resolved.conf b/systemd/resolved.conf
index 80297204..72ae7b43 100644
--- a/systemd/resolved.conf
+++ b/systemd/resolved.conf
@@ -13,7 +13,7 @@
 
 [Resolve]
 #DNS=
-#FallbackDNS=8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844
+#FallbackDNS=
 #Domains=
 #LLMNR=yes
 #MulticastDNS=yes