diff --git a/systemd/ndn-traffic-client.service.in b/systemd/ndn-traffic-client.service.in
new file mode 100644
index 0000000..9ffac02
--- /dev/null
+++ b/systemd/ndn-traffic-client.service.in
@@ -0,0 +1,42 @@
+[Unit]
+Description=NDN Traffic Generator Client
+BindsTo=nfd.service
+After=nfd.service
+
+[Service]
+Environment=HOME=%S/ndn/ndn-traffic-client
+EnvironmentFile=-@SYSCONFDIR@/default/ndn-traffic-client
+ExecStart=@BINDIR@/ndn-traffic-client @SYSCONFDIR@/ndn/ndn-traffic-client.conf $FLAGS
+Restart=on-failure
+RestartPreventExitStatus=2
+User=ndn-traffic-generator
+
+CapabilityBoundingSet=
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+# systemd older than v232 doesn't support a value of "strict" for ProtectSystem,
+# so it will ignore that line and use ProtectSystem=full; with newer systemd,
+# the latter assignment is recognized and takes precedence, resulting in an
+# effective setting of ProtectSystem=strict
+ProtectSystem=full
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+StateDirectory=ndn/ndn-traffic-client
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=~@aio @chown @clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap
+
+[Install]
+WantedBy=multi-user.target
+WantedBy=nfd.service
diff --git a/systemd/ndn-traffic-server.service.in b/systemd/ndn-traffic-server.service.in
new file mode 100644
index 0000000..91554d0
--- /dev/null
+++ b/systemd/ndn-traffic-server.service.in
@@ -0,0 +1,42 @@
+[Unit]
+Description=NDN Traffic Generator Server
+BindsTo=nfd.service
+After=nfd.service
+
+[Service]
+Environment=HOME=%S/ndn/ndn-traffic-server
+EnvironmentFile=-@SYSCONFDIR@/default/ndn-traffic-server
+ExecStart=@BINDIR@/ndn-traffic-server @SYSCONFDIR@/ndn/ndn-traffic-server.conf $FLAGS
+Restart=on-failure
+RestartPreventExitStatus=2
+User=ndn-traffic-generator
+
+CapabilityBoundingSet=
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+# systemd older than v232 doesn't support a value of "strict" for ProtectSystem,
+# so it will ignore that line and use ProtectSystem=full; with newer systemd,
+# the latter assignment is recognized and takes precedence, resulting in an
+# effective setting of ProtectSystem=strict
+ProtectSystem=full
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+StateDirectory=ndn/ndn-traffic-server
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=~@aio @chown @clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap
+
+[Install]
+WantedBy=multi-user.target
+WantedBy=nfd.service
diff --git a/wscript b/wscript
index 960ffb0..6c65c50 100644
--- a/wscript
+++ b/wscript
@@ -33,3 +33,10 @@
 
     bld.install_files('${SYSCONFDIR}/ndn', ['ndn-traffic-client.conf.sample',
                                             'ndn-traffic-server.conf.sample'])
+
+    if Utils.unversioned_sys_platform() == 'linux':
+        systemd_units = bld.path.ant_glob('systemd/*.in')
+        bld(features='subst',
+            name='systemd-units',
+            source=systemd_units,
+            target=[u.change_ext('') for u in systemd_units])