diff --git a/contrib/deb/generate.sh b/contrib/deb/generate.sh
index 1f3186a4..3ab4bf53 100644
--- a/contrib/deb/generate.sh
+++ b/contrib/deb/generate.sh
@@ -39,6 +39,7 @@ mkdir -p /tmp/$PKGNAME/
 mkdir -p /tmp/$PKGNAME/debian/
 mkdir -p /tmp/$PKGNAME/usr/bin/
 mkdir -p /tmp/$PKGNAME/etc/systemd/system/
+mkdir -p /tmp/$PKGNAME/etc/apparmor.d/
 
 cat > /tmp/$PKGNAME/debian/changelog << EOF
 Please see https://github.com/yggdrasil-network/yggdrasil-go/
@@ -69,6 +70,7 @@ cat > /tmp/$PKGNAME/debian/install << EOF
 usr/bin/yggdrasil usr/bin
 usr/bin/yggdrasilctl usr/bin
 etc/systemd/system/*.service etc/systemd/system
+etc/apparmor.d/* etc/apparmor.d
 EOF
 cat > /tmp/$PKGNAME/debian/postinst << EOF
 #!/bin/sh
@@ -77,13 +79,19 @@ if ! getent group yggdrasil 2>&1 > /dev/null; then
   groupadd --system --force yggdrasil || echo "Failed to create group 'yggdrasil' - please create it manually and reinstall"
 fi
 
+if command -v systemctl >/dev/null; then
+  if command -v aa-status >/dev/null; then
+    systemctl restart apparmor || true
+  fi
+fi
+
 if [ -f /etc/yggdrasil.conf ];
 then
   mkdir -p /var/backups
   echo "Backing up configuration file to /var/backups/yggdrasil.conf.`date +%Y%m%d`"
   cp /etc/yggdrasil.conf /var/backups/yggdrasil.conf.`date +%Y%m%d`
   echo "Normalising and updating /etc/yggdrasil.conf"
-  /usr/bin/yggdrasil -useconffile /var/backups/yggdrasil.conf.`date +%Y%m%d` -normaliseconf > /etc/yggdrasil.conf
+  /usr/bin/yggdrasil -useconf -normaliseconf < /var/backups/yggdrasil.conf.`date +%Y%m%d` > /etc/yggdrasil.conf
   chgrp yggdrasil /etc/yggdrasil.conf
 
   if command -v systemctl >/dev/null; then
@@ -111,11 +119,13 @@ EOF
 cp yggdrasil /tmp/$PKGNAME/usr/bin/
 cp yggdrasilctl /tmp/$PKGNAME/usr/bin/
 cp contrib/systemd/*.service /tmp/$PKGNAME/etc/systemd/system/
+cp contrib/apparmor/usr.bin.yggdrasil /tmp/$PKGNAME/etc/apparmor.d/
 
 tar -czvf /tmp/$PKGNAME/data.tar.gz -C /tmp/$PKGNAME/ \
   usr/bin/yggdrasil usr/bin/yggdrasilctl \
   etc/systemd/system/yggdrasil.service \
-  etc/systemd/system/yggdrasil-default-config.service
+  etc/systemd/system/yggdrasil-default-config.service \
+  etc/apparmor.d/usr.bin.yggdrasil
 tar -czvf /tmp/$PKGNAME/control.tar.gz -C /tmp/$PKGNAME/debian .
 echo 2.0 > /tmp/$PKGNAME/debian-binary