diff --git a/dnssec-trigger-842455.patch b/dnssec-trigger-842455.patch
new file mode 100644
index 0000000..c92cc6c
--- /dev/null
+++ b/dnssec-trigger-842455.patch
@@ -0,0 +1,10 @@
+--- dnssec-trigger-0.11-orig/riggerd/riggerd.c	2012-07-24 10:27:43.638865272 -0400
++++ dnssec-trigger-0.11/riggerd/riggerd.c	2012-07-24 10:51:39.910814143 -0400
+@@ -298,6 +298,7 @@
+ 	   so that during the reboot there is no window of opportunity */ 
+ 	if(svr->insecure_state)
+ 		hook_resolv_localhost(cfg);
++	hook_resolv_uninstall(cfg); /* we want to remove immutable flag on TERM when systemd signals us */
+ 	unlink_pid(cfg->pidfile);
+ 	log_info("%s stop", PACKAGE_STRING);
+ 	svr_delete(svr);
diff --git a/dnssec-trigger.spec b/dnssec-trigger.spec
index eed2a60..8085852 100644
--- a/dnssec-trigger.spec
+++ b/dnssec-trigger.spec
@@ -1,7 +1,7 @@
 Summary: NetworkManager plugin to update/reconfigure DNSSEC resolving
 Name: dnssec-trigger
 Version: 0.11
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/downloads/dnssec-trigger/
 Source: http://www.nlnetlabs.nl/downloads/dnssec-trigger/%{name}-%{version}.tar.gz
@@ -101,6 +101,9 @@ fi
     /bin/systemctl daemon-reload >/dev/null 2>&1 || :
 
 %changelog
+* Tue Jul 24 2012 Paul Wouters <pwouters@redhat.com> - 0.11-5
+- On service stop, remove immutable attr from resolv.conf (rhbz#842455)
+
 * Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.11-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
 
diff --git a/dnssec-triggerd.service b/dnssec-triggerd.service
index 4d2a2c7..1fc600d 100644
--- a/dnssec-triggerd.service
+++ b/dnssec-triggerd.service
@@ -13,6 +13,8 @@ ExecStart=/usr/sbin/dnssec-triggerd -d
 ExecStartPost=/etc/NetworkManager/dispatcher.d/01-dnssec-trigger-hook
 Restart=always
 RestartSec=0
+# filing bug upstream to fix this, rhbz#842455
+ExecStopPost=chattr -i /etc/resolv.conf
 
 [Install]
 WantedBy=multi-user.target
diff --git a/sources b/sources
index d06c834..3131e3d 100644
--- a/sources
+++ b/sources
@@ -1,3 +1 @@
-7c4b5b9e0060b47da6e08cfbe64e3563  dnssec-trigger-0.9.tar.gz
-c978126c1a5f40a6022e459e30c87550  dnssec-trigger-0.10.tar.gz
 7efb79cb5813b1fab10c4a9518810431  dnssec-trigger-0.11.tar.gz