diff --git a/dnscrypt-proxy/systemd_linux.go b/dnscrypt-proxy/systemd_linux.go
index 652c70ae..e05758f8 100644
--- a/dnscrypt-proxy/systemd_linux.go
+++ b/dnscrypt-proxy/systemd_linux.go
@@ -11,6 +11,10 @@ import (
 func (proxy *Proxy) SystemDListeners() error {
 	files := activation.Files(true)
 
+	if len(files) > 0 && (len(proxy.userName) > 0 || proxy.child) {
+		dlog.Fatal("Systemd activated sockets are incompatible with privilege dropping. Remove activated sockets and fill `listen_addresses` in the dnscrypt-proxy configuration file instead.")
+	}
+
 	for i, file := range files {
 		if listener, err := net.FileListener(file); err == nil {
 			dlog.Noticef("Wiring systemd TCP socket #%d, %s, %s", i, file.Name(), listener.Addr())